]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
Fixes for 4.19
authorSasha Levin <sashal@kernel.org>
Sun, 25 Sep 2022 01:52:31 +0000 (21:52 -0400)
committerSasha Levin <sashal@kernel.org>
Sun, 25 Sep 2022 01:52:31 +0000 (21:52 -0400)
Signed-off-by: Sasha Levin <sashal@kernel.org>
17 files changed:
queue-4.19/arm64-dts-rockchip-remove-enable-active-low-from-rk3.patch [new file with mode: 0644]
queue-4.19/arm64-dts-rockchip-set-rk3399-gru-pclk_edp-to-24-mhz.patch [new file with mode: 0644]
queue-4.19/can-gs_usb-gs_can_open-fix-race-dev-can.state-condit.patch [new file with mode: 0644]
queue-4.19/i40e-fix-set-max_tx_rate-when-it-is-lower-than-1-mbp.patch [new file with mode: 0644]
queue-4.19/i40e-fix-vf-set-max-mtu-size.patch [new file with mode: 0644]
queue-4.19/iavf-fix-cached-head-and-tail-value-for-iavf_get_tx_.patch [new file with mode: 0644]
queue-4.19/ipvlan-fix-out-of-bound-bugs-caused-by-unset-skb-mac.patch [new file with mode: 0644]
queue-4.19/mips-lantiq-export-clk_get_io-for-lantiq_wdt.ko.patch [new file with mode: 0644]
queue-4.19/net-sunhme-fix-packet-reception-for-len-rx_copy_thre.patch [new file with mode: 0644]
queue-4.19/net-team-unsync-device-addresses-on-ndo_stop.patch [new file with mode: 0644]
queue-4.19/netfilter-ebtables-fix-memory-leak-when-blob-is-malf.patch [new file with mode: 0644]
queue-4.19/netfilter-nf_conntrack_irc-tighten-matching-on-dcc-m.patch [new file with mode: 0644]
queue-4.19/netfilter-nf_conntrack_sip-fix-ct_sip_walk_headers.patch [new file with mode: 0644]
queue-4.19/of-mdio-add-of_node_put-when-breaking-out-of-for_eac.patch [new file with mode: 0644]
queue-4.19/perf-jit-include-program-header-in-elf-files.patch [new file with mode: 0644]
queue-4.19/perf-kcore_copy-do-not-check-proc-modules-is-unchang.patch [new file with mode: 0644]
queue-4.19/series

diff --git a/queue-4.19/arm64-dts-rockchip-remove-enable-active-low-from-rk3.patch b/queue-4.19/arm64-dts-rockchip-remove-enable-active-low-from-rk3.patch
new file mode 100644 (file)
index 0000000..56efcfb
--- /dev/null
@@ -0,0 +1,40 @@
+From 61cb52e01bb28d6e4f9d362041e7e892862546df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 27 Aug 2022 14:51:39 -0300
+Subject: arm64: dts: rockchip: Remove 'enable-active-low' from rk3399-puma
+
+From: Fabio Estevam <festevam@denx.de>
+
+[ Upstream commit a994b34b9abb9c08ee09e835b4027ff2147f9d94 ]
+
+The 'enable-active-low' property is not a valid one.
+
+Only 'enable-active-high' is valid, and when this property is absent
+the gpio regulator will act as active low by default.
+
+Remove the invalid 'enable-active-low' property.
+
+Fixes: 2c66fc34e945 ("arm64: dts: rockchip: add RK3399-Q7 (Puma) SoM")
+Signed-off-by: Fabio Estevam <festevam@denx.de>
+Link: https://lore.kernel.org/r/20220827175140.1696699-1-festevam@denx.de
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi
+index ce1320e4c106..6750b8100421 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi
+@@ -102,7 +102,6 @@ vcc3v3_sys: vcc3v3-sys {
+       vcc5v0_host: vcc5v0-host-regulator {
+               compatible = "regulator-fixed";
+               gpio = <&gpio4 RK_PA3 GPIO_ACTIVE_LOW>;
+-              enable-active-low;
+               pinctrl-names = "default";
+               pinctrl-0 = <&vcc5v0_host_en>;
+               regulator-name = "vcc5v0_host";
+-- 
+2.35.1
+
diff --git a/queue-4.19/arm64-dts-rockchip-set-rk3399-gru-pclk_edp-to-24-mhz.patch b/queue-4.19/arm64-dts-rockchip-set-rk3399-gru-pclk_edp-to-24-mhz.patch
new file mode 100644 (file)
index 0000000..6d1867e
--- /dev/null
@@ -0,0 +1,51 @@
+From 500da88fb4afaca64e51954048cd01f406fa96b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Aug 2022 13:16:17 -0700
+Subject: arm64: dts: rockchip: Set RK3399-Gru PCLK_EDP to 24 MHz
+
+From: zain wang <wzz@rock-chips.com>
+
+[ Upstream commit 8123437cf46ea5a0f6ca5cb3c528d8b6db97b9c2 ]
+
+We've found the AUX channel to be less reliable with PCLK_EDP at a
+higher rate (typically 25 MHz). This is especially important on systems
+with PSR-enabled panels (like Gru-Kevin), since we make heavy, constant
+use of AUX.
+
+According to Rockchip, using any rate other than 24 MHz can cause
+"problems between syncing the PHY an PCLK", which leads to all sorts of
+unreliabilities around register operations.
+
+Fixes: d67a38c5a623 ("arm64: dts: rockchip: move core edp from rk3399-kevin to shared chromebook")
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: zain wang <wzz@rock-chips.com>
+Signed-off-by: Brian Norris <briannorris@chromium.org>
+Link: https://lore.kernel.org/r/20220830131212.v2.1.I98d30623f13b785ca77094d0c0fd4339550553b6@changeid
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3399-gru-chromebook.dtsi | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3399-gru-chromebook.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-gru-chromebook.dtsi
+index ff81dfda3b95..3ba927f30347 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3399-gru-chromebook.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3399-gru-chromebook.dtsi
+@@ -232,6 +232,14 @@ &cdn_dp {
+ &edp {
+       status = "okay";
++      /*
++       * eDP PHY/clk don't sync reliably at anything other than 24 MHz. Only
++       * set this here, because rk3399-gru.dtsi ensures we can generate this
++       * off GPLL=600MHz, whereas some other RK3399 boards may not.
++       */
++      assigned-clocks = <&cru PCLK_EDP>;
++      assigned-clock-rates = <24000000>;
++
+       ports {
+               edp_out: port@1 {
+                       reg = <1>;
+-- 
+2.35.1
+
diff --git a/queue-4.19/can-gs_usb-gs_can_open-fix-race-dev-can.state-condit.patch b/queue-4.19/can-gs_usb-gs_can_open-fix-race-dev-can.state-condit.patch
new file mode 100644 (file)
index 0000000..e382dbf
--- /dev/null
@@ -0,0 +1,55 @@
+From 9dbd13bb81b2084e967b5ce191bab7af37b91701 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Sep 2022 11:40:56 +0200
+Subject: can: gs_usb: gs_can_open(): fix race dev->can.state condition
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+[ Upstream commit 5440428b3da65408dba0241985acb7a05258b85e ]
+
+The dev->can.state is set to CAN_STATE_ERROR_ACTIVE, after the device
+has been started. On busy networks the CAN controller might receive
+CAN frame between and go into an error state before the dev->can.state
+is assigned.
+
+Assign dev->can.state before starting the controller to close the race
+window.
+
+Fixes: d08e973a77d1 ("can: gs_usb: Added support for the GS_USB CAN devices")
+Link: https://lore.kernel.org/all/20220920195216.232481-1-mkl@pengutronix.de
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/usb/gs_usb.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c
+index 2101b2fab7df..62ca4964a863 100644
+--- a/drivers/net/can/usb/gs_usb.c
++++ b/drivers/net/can/usb/gs_usb.c
+@@ -686,6 +686,7 @@ static int gs_can_open(struct net_device *netdev)
+               flags |= GS_CAN_MODE_TRIPLE_SAMPLE;
+       /* finally start device */
++      dev->can.state = CAN_STATE_ERROR_ACTIVE;
+       dm->mode = cpu_to_le32(GS_CAN_MODE_START);
+       dm->flags = cpu_to_le32(flags);
+       rc = usb_control_msg(interface_to_usbdev(dev->iface),
+@@ -702,13 +703,12 @@ static int gs_can_open(struct net_device *netdev)
+       if (rc < 0) {
+               netdev_err(netdev, "Couldn't start device (err=%d)\n", rc);
+               kfree(dm);
++              dev->can.state = CAN_STATE_STOPPED;
+               return rc;
+       }
+       kfree(dm);
+-      dev->can.state = CAN_STATE_ERROR_ACTIVE;
+-
+       parent->active_channels++;
+       if (!(dev->can.ctrlmode & CAN_CTRLMODE_LISTENONLY))
+               netif_start_queue(netdev);
+-- 
+2.35.1
+
diff --git a/queue-4.19/i40e-fix-set-max_tx_rate-when-it-is-lower-than-1-mbp.patch b/queue-4.19/i40e-fix-set-max_tx_rate-when-it-is-lower-than-1-mbp.patch
new file mode 100644 (file)
index 0000000..a535145
--- /dev/null
@@ -0,0 +1,100 @@
+From 72e4f441727d91719a4d082c2dc7c78a17979baf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Sep 2022 09:49:33 +0200
+Subject: i40e: Fix set max_tx_rate when it is lower than 1 Mbps
+
+From: Michal Jaron <michalx.jaron@intel.com>
+
+[ Upstream commit 198eb7e1b81d8ba676d0f4f120c092032ae69a8e ]
+
+While converting max_tx_rate from bytes to Mbps, this value was set to 0,
+if the original value was lower than 125000 bytes (1 Mbps). This would
+cause no transmission rate limiting to occur. This happened due to lack of
+check of max_tx_rate against the 1 Mbps value for max_tx_rate and the
+following division by 125000. Fix this issue by adding a helper
+i40e_bw_bytes_to_mbits() which sets max_tx_rate to minimum usable value of
+50 Mbps, if its value is less than 1 Mbps, otherwise do the required
+conversion by dividing by 125000.
+
+Fixes: 5ecae4120a6b ("i40e: Refactor VF BW rate limiting")
+Signed-off-by: Michal Jaron <michalx.jaron@intel.com>
+Signed-off-by: Andrii Staikov <andrii.staikov@intel.com>
+Tested-by: Bharathi Sreenivas <bharathi.sreenivas@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_main.c | 32 +++++++++++++++++----
+ 1 file changed, 26 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
+index 85337806efc7..9669d8c8b6c7 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -5487,6 +5487,26 @@ static int i40e_get_link_speed(struct i40e_vsi *vsi)
+       }
+ }
++/**
++ * i40e_bw_bytes_to_mbits - Convert max_tx_rate from bytes to mbits
++ * @vsi: Pointer to vsi structure
++ * @max_tx_rate: max TX rate in bytes to be converted into Mbits
++ *
++ * Helper function to convert units before send to set BW limit
++ **/
++static u64 i40e_bw_bytes_to_mbits(struct i40e_vsi *vsi, u64 max_tx_rate)
++{
++      if (max_tx_rate < I40E_BW_MBPS_DIVISOR) {
++              dev_warn(&vsi->back->pdev->dev,
++                       "Setting max tx rate to minimum usable value of 50Mbps.\n");
++              max_tx_rate = I40E_BW_CREDIT_DIVISOR;
++      } else {
++              do_div(max_tx_rate, I40E_BW_MBPS_DIVISOR);
++      }
++
++      return max_tx_rate;
++}
++
+ /**
+  * i40e_set_bw_limit - setup BW limit for Tx traffic based on max_tx_rate
+  * @vsi: VSI to be configured
+@@ -5509,10 +5529,10 @@ int i40e_set_bw_limit(struct i40e_vsi *vsi, u16 seid, u64 max_tx_rate)
+                       max_tx_rate, seid);
+               return -EINVAL;
+       }
+-      if (max_tx_rate && max_tx_rate < 50) {
++      if (max_tx_rate && max_tx_rate < I40E_BW_CREDIT_DIVISOR) {
+               dev_warn(&pf->pdev->dev,
+                        "Setting max tx rate to minimum usable value of 50Mbps.\n");
+-              max_tx_rate = 50;
++              max_tx_rate = I40E_BW_CREDIT_DIVISOR;
+       }
+       /* Tx rate credits are in values of 50Mbps, 0 is disabled */
+@@ -6949,9 +6969,9 @@ static int i40e_setup_tc(struct net_device *netdev, void *type_data)
+       if (pf->flags & I40E_FLAG_TC_MQPRIO) {
+               if (vsi->mqprio_qopt.max_rate[0]) {
+-                      u64 max_tx_rate = vsi->mqprio_qopt.max_rate[0];
++                      u64 max_tx_rate = i40e_bw_bytes_to_mbits(vsi,
++                                                vsi->mqprio_qopt.max_rate[0]);
+-                      do_div(max_tx_rate, I40E_BW_MBPS_DIVISOR);
+                       ret = i40e_set_bw_limit(vsi, vsi->seid, max_tx_rate);
+                       if (!ret) {
+                               u64 credits = max_tx_rate;
+@@ -9613,10 +9633,10 @@ static void i40e_rebuild(struct i40e_pf *pf, bool reinit, bool lock_acquired)
+       }
+       if (vsi->mqprio_qopt.max_rate[0]) {
+-              u64 max_tx_rate = vsi->mqprio_qopt.max_rate[0];
++              u64 max_tx_rate = i40e_bw_bytes_to_mbits(vsi,
++                                                vsi->mqprio_qopt.max_rate[0]);
+               u64 credits = 0;
+-              do_div(max_tx_rate, I40E_BW_MBPS_DIVISOR);
+               ret = i40e_set_bw_limit(vsi, vsi->seid, max_tx_rate);
+               if (ret)
+                       goto end_unlock;
+-- 
+2.35.1
+
diff --git a/queue-4.19/i40e-fix-vf-set-max-mtu-size.patch b/queue-4.19/i40e-fix-vf-set-max-mtu-size.patch
new file mode 100644 (file)
index 0000000..077d32c
--- /dev/null
@@ -0,0 +1,67 @@
+From 69ed9bf7b2138f747aa07c759173e2f9967f8df5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Sep 2022 15:38:36 +0200
+Subject: i40e: Fix VF set max MTU size
+
+From: Michal Jaron <michalx.jaron@intel.com>
+
+[ Upstream commit 372539def2824c43b6afe2403045b140f65c5acc ]
+
+Max MTU sent to VF is set to 0 during memory allocation. It cause
+that max MTU on VF is changed to IAVF_MAX_RXBUFFER and does not
+depend on data from HW.
+
+Set max_mtu field in virtchnl_vf_resource struct to inform
+VF in GET_VF_RESOURCES msg what size should be max frame.
+
+Fixes: dab86afdbbd1 ("i40e/i40evf: Change the way we limit the maximum frame size for Rx")
+Signed-off-by: Michal Jaron <michalx.jaron@intel.com>
+Signed-off-by: Mateusz Palczewski <mateusz.palczewski@intel.com>
+Tested-by: Konrad Jankowski <konrad0.jankowski@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../ethernet/intel/i40e/i40e_virtchnl_pf.c    | 20 +++++++++++++++++++
+ 1 file changed, 20 insertions(+)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+index a39a8fe073ca..973350b34e08 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+@@ -1712,6 +1712,25 @@ static void i40e_del_qch(struct i40e_vf *vf)
+       }
+ }
++/**
++ * i40e_vc_get_max_frame_size
++ * @vf: pointer to the VF
++ *
++ * Max frame size is determined based on the current port's max frame size and
++ * whether a port VLAN is configured on this VF. The VF is not aware whether
++ * it's in a port VLAN so the PF needs to account for this in max frame size
++ * checks and sending the max frame size to the VF.
++ **/
++static u16 i40e_vc_get_max_frame_size(struct i40e_vf *vf)
++{
++      u16 max_frame_size = vf->pf->hw.phy.link_info.max_frame_size;
++
++      if (vf->port_vlan_id)
++              max_frame_size -= VLAN_HLEN;
++
++      return max_frame_size;
++}
++
+ /**
+  * i40e_vc_get_vf_resources_msg
+  * @vf: pointer to the VF info
+@@ -1814,6 +1833,7 @@ static int i40e_vc_get_vf_resources_msg(struct i40e_vf *vf, u8 *msg)
+       vfres->max_vectors = pf->hw.func_caps.num_msix_vectors_vf;
+       vfres->rss_key_size = I40E_HKEY_ARRAY_SIZE;
+       vfres->rss_lut_size = I40E_VF_HLUT_ARRAY_SIZE;
++      vfres->max_mtu = i40e_vc_get_max_frame_size(vf);
+       if (vf->lan_vsi_idx) {
+               vfres->vsi_res[0].vsi_id = vf->lan_vsi_id;
+-- 
+2.35.1
+
diff --git a/queue-4.19/iavf-fix-cached-head-and-tail-value-for-iavf_get_tx_.patch b/queue-4.19/iavf-fix-cached-head-and-tail-value-for-iavf_get_tx_.patch
new file mode 100644 (file)
index 0000000..1db6384
--- /dev/null
@@ -0,0 +1,45 @@
+From 49c4787d545a9972105648e79fd8a617d23c2289 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Sep 2022 16:34:40 +0200
+Subject: iavf: Fix cached head and tail value for iavf_get_tx_pending
+
+From: Brett Creeley <brett.creeley@intel.com>
+
+[ Upstream commit 809f23c0423a43266e47a7dc67e95b5cb4d1cbfc ]
+
+The underlying hardware may or may not allow reading of the head or tail
+registers and it really makes no difference if we use the software
+cached values. So, always used the software cached values.
+
+Fixes: 9c6c12595b73 ("i40e: Detection and recovery of TX queue hung logic moved to service_task from tx_timeout")
+Signed-off-by: Brett Creeley <brett.creeley@intel.com>
+Co-developed-by: Norbert Zulinski <norbertx.zulinski@intel.com>
+Signed-off-by: Norbert Zulinski <norbertx.zulinski@intel.com>
+Signed-off-by: Mateusz Palczewski <mateusz.palczewski@intel.com>
+Tested-by: Konrad Jankowski <konrad0.jankowski@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40evf/i40e_txrx.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/intel/i40evf/i40e_txrx.c b/drivers/net/ethernet/intel/i40evf/i40e_txrx.c
+index b56d22b530a7..1bf9734ae9cf 100644
+--- a/drivers/net/ethernet/intel/i40evf/i40e_txrx.c
++++ b/drivers/net/ethernet/intel/i40evf/i40e_txrx.c
+@@ -115,8 +115,11 @@ u32 i40evf_get_tx_pending(struct i40e_ring *ring, bool in_sw)
+ {
+       u32 head, tail;
++      /* underlying hardware might not allow access and/or always return
++       * 0 for the head/tail registers so just use the cached values
++       */
+       head = ring->next_to_clean;
+-      tail = readl(ring->tail);
++      tail = ring->next_to_use;
+       if (head != tail)
+               return (head < tail) ?
+-- 
+2.35.1
+
diff --git a/queue-4.19/ipvlan-fix-out-of-bound-bugs-caused-by-unset-skb-mac.patch b/queue-4.19/ipvlan-fix-out-of-bound-bugs-caused-by-unset-skb-mac.patch
new file mode 100644 (file)
index 0000000..d39c050
--- /dev/null
@@ -0,0 +1,98 @@
+From 358948d39b1fdc53f7ebf223658a20ed800439e9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Sep 2022 18:12:04 +0800
+Subject: ipvlan: Fix out-of-bound bugs caused by unset skb->mac_header
+
+From: Lu Wei <luwei32@huawei.com>
+
+[ Upstream commit 81225b2ea161af48e093f58e8dfee6d705b16af4 ]
+
+If an AF_PACKET socket is used to send packets through ipvlan and the
+default xmit function of the AF_PACKET socket is changed from
+dev_queue_xmit() to packet_direct_xmit() via setsockopt() with the option
+name of PACKET_QDISC_BYPASS, the skb->mac_header may not be reset and
+remains as the initial value of 65535, this may trigger slab-out-of-bounds
+bugs as following:
+
+=================================================================
+UG: KASAN: slab-out-of-bounds in ipvlan_xmit_mode_l2+0xdb/0x330 [ipvlan]
+PU: 2 PID: 1768 Comm: raw_send Kdump: loaded Not tainted 6.0.0-rc4+ #6
+ardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33
+all Trace:
+print_address_description.constprop.0+0x1d/0x160
+print_report.cold+0x4f/0x112
+kasan_report+0xa3/0x130
+ipvlan_xmit_mode_l2+0xdb/0x330 [ipvlan]
+ipvlan_start_xmit+0x29/0xa0 [ipvlan]
+__dev_direct_xmit+0x2e2/0x380
+packet_direct_xmit+0x22/0x60
+packet_snd+0x7c9/0xc40
+sock_sendmsg+0x9a/0xa0
+__sys_sendto+0x18a/0x230
+__x64_sys_sendto+0x74/0x90
+do_syscall_64+0x3b/0x90
+entry_SYSCALL_64_after_hwframe+0x63/0xcd
+
+The root cause is:
+  1. packet_snd() only reset skb->mac_header when sock->type is SOCK_RAW
+     and skb->protocol is not specified as in packet_parse_headers()
+
+  2. packet_direct_xmit() doesn't reset skb->mac_header as dev_queue_xmit()
+
+In this case, skb->mac_header is 65535 when ipvlan_xmit_mode_l2() is
+called. So when ipvlan_xmit_mode_l2() gets mac header with eth_hdr() which
+use "skb->head + skb->mac_header", out-of-bound access occurs.
+
+This patch replaces eth_hdr() with skb_eth_hdr() in ipvlan_xmit_mode_l2()
+and reset mac header in multicast to solve this out-of-bound bug.
+
+Fixes: 2ad7bf363841 ("ipvlan: Initial check-in of the IPVLAN driver.")
+Signed-off-by: Lu Wei <luwei32@huawei.com>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ipvlan/ipvlan_core.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ipvlan/ipvlan_core.c b/drivers/net/ipvlan/ipvlan_core.c
+index 40ac60904c8d..63f0226b0a70 100644
+--- a/drivers/net/ipvlan/ipvlan_core.c
++++ b/drivers/net/ipvlan/ipvlan_core.c
+@@ -502,7 +502,6 @@ static int ipvlan_process_v6_outbound(struct sk_buff *skb)
+ static int ipvlan_process_outbound(struct sk_buff *skb)
+ {
+-      struct ethhdr *ethh = eth_hdr(skb);
+       int ret = NET_XMIT_DROP;
+       /* The ipvlan is a pseudo-L2 device, so the packets that we receive
+@@ -512,6 +511,8 @@ static int ipvlan_process_outbound(struct sk_buff *skb)
+       if (skb_mac_header_was_set(skb)) {
+               /* In this mode we dont care about
+                * multicast and broadcast traffic */
++              struct ethhdr *ethh = eth_hdr(skb);
++
+               if (is_multicast_ether_addr(ethh->h_dest)) {
+                       pr_debug_ratelimited(
+                               "Dropped {multi|broad}cast of type=[%x]\n",
+@@ -596,7 +597,7 @@ static int ipvlan_xmit_mode_l3(struct sk_buff *skb, struct net_device *dev)
+ static int ipvlan_xmit_mode_l2(struct sk_buff *skb, struct net_device *dev)
+ {
+       const struct ipvl_dev *ipvlan = netdev_priv(dev);
+-      struct ethhdr *eth = eth_hdr(skb);
++      struct ethhdr *eth = skb_eth_hdr(skb);
+       struct ipvl_addr *addr;
+       void *lyr3h;
+       int addr_type;
+@@ -626,6 +627,7 @@ static int ipvlan_xmit_mode_l2(struct sk_buff *skb, struct net_device *dev)
+               return dev_forward_skb(ipvlan->phy_dev, skb);
+       } else if (is_multicast_ether_addr(eth->h_dest)) {
++              skb_reset_mac_header(skb);
+               ipvlan_skb_crossing_ns(skb, NULL);
+               ipvlan_multicast_enqueue(ipvlan->port, skb, true);
+               return NET_XMIT_SUCCESS;
+-- 
+2.35.1
+
diff --git a/queue-4.19/mips-lantiq-export-clk_get_io-for-lantiq_wdt.ko.patch b/queue-4.19/mips-lantiq-export-clk_get_io-for-lantiq_wdt.ko.patch
new file mode 100644 (file)
index 0000000..390bca8
--- /dev/null
@@ -0,0 +1,41 @@
+From b9eb1758bd79a631b4e3f14fb9003ddae21cdd55 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 17 Sep 2022 16:25:40 -0700
+Subject: MIPS: lantiq: export clk_get_io() for lantiq_wdt.ko
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 502550123bee6a2ffa438409b5b9aad4d6db3a8c ]
+
+The lantiq WDT driver uses clk_get_io(), which is not exported,
+so export it to fix a build error:
+
+ERROR: modpost: "clk_get_io" [drivers/watchdog/lantiq_wdt.ko] undefined!
+
+Fixes: 287e3f3f4e68 ("MIPS: lantiq: implement support for clkdev api")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Reported-by: kernel test robot <lkp@intel.com>
+Cc: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Cc: John Crispin <john@phrozen.org>
+Cc: linux-mips@vger.kernel.org
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/lantiq/clk.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/mips/lantiq/clk.c b/arch/mips/lantiq/clk.c
+index f5fab99d1751..851f6bf925a6 100644
+--- a/arch/mips/lantiq/clk.c
++++ b/arch/mips/lantiq/clk.c
+@@ -52,6 +52,7 @@ struct clk *clk_get_io(void)
+ {
+       return &cpu_clk_generic[2];
+ }
++EXPORT_SYMBOL_GPL(clk_get_io);
+ struct clk *clk_get_ppe(void)
+ {
+-- 
+2.35.1
+
diff --git a/queue-4.19/net-sunhme-fix-packet-reception-for-len-rx_copy_thre.patch b/queue-4.19/net-sunhme-fix-packet-reception-for-len-rx_copy_thre.patch
new file mode 100644 (file)
index 0000000..baef4d1
--- /dev/null
@@ -0,0 +1,58 @@
+From 69105ed582041bc5c65222efea4dbbfbb5962148 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Sep 2022 19:50:18 -0400
+Subject: net: sunhme: Fix packet reception for len < RX_COPY_THRESHOLD
+
+From: Sean Anderson <seanga2@gmail.com>
+
+[ Upstream commit 878e2405710aacfeeb19364c300f38b7a9abfe8f ]
+
+There is a separate receive path for small packets (under 256 bytes).
+Instead of allocating a new dma-capable skb to be used for the next packet,
+this path allocates a skb and copies the data into it (reusing the existing
+sbk for the next packet). There are two bytes of junk data at the beginning
+of every packet. I believe these are inserted in order to allow aligned DMA
+and IP headers. We skip over them using skb_reserve. Before copying over
+the data, we must use a barrier to ensure we see the whole packet. The
+current code only synchronizes len bytes, starting from the beginning of
+the packet, including the junk bytes. However, this leaves off the final
+two bytes in the packet. Synchronize the whole packet.
+
+To reproduce this problem, ping a HME with a payload size between 17 and
+214
+
+       $ ping -s 17 <hme_address>
+
+which will complain rather loudly about the data mismatch. Small packets
+(below 60 bytes on the wire) do not have this issue. I suspect this is
+related to the padding added to increase the minimum packet size.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Sean Anderson <seanga2@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://lore.kernel.org/r/20220920235018.1675956-1-seanga2@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/sun/sunhme.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/sun/sunhme.c b/drivers/net/ethernet/sun/sunhme.c
+index 882908e74cc9..a4090163d870 100644
+--- a/drivers/net/ethernet/sun/sunhme.c
++++ b/drivers/net/ethernet/sun/sunhme.c
+@@ -2064,9 +2064,9 @@ static void happy_meal_rx(struct happy_meal *hp, struct net_device *dev)
+                       skb_reserve(copy_skb, 2);
+                       skb_put(copy_skb, len);
+-                      dma_sync_single_for_cpu(hp->dma_dev, dma_addr, len, DMA_FROM_DEVICE);
++                      dma_sync_single_for_cpu(hp->dma_dev, dma_addr, len + 2, DMA_FROM_DEVICE);
+                       skb_copy_from_linear_data(skb, copy_skb->data, len);
+-                      dma_sync_single_for_device(hp->dma_dev, dma_addr, len, DMA_FROM_DEVICE);
++                      dma_sync_single_for_device(hp->dma_dev, dma_addr, len + 2, DMA_FROM_DEVICE);
+                       /* Reuse original ring buffer. */
+                       hme_write_rxd(hp, this,
+                                     (RXFLAG_OWN|((RX_BUF_ALLOC_SIZE-RX_OFFSET)<<16)),
+-- 
+2.35.1
+
diff --git a/queue-4.19/net-team-unsync-device-addresses-on-ndo_stop.patch b/queue-4.19/net-team-unsync-device-addresses-on-ndo_stop.patch
new file mode 100644 (file)
index 0000000..09e11e9
--- /dev/null
@@ -0,0 +1,87 @@
+From ed2296494fcf2f80fb724764086117176aeb902d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Sep 2022 16:56:41 +0900
+Subject: net: team: Unsync device addresses on ndo_stop
+
+From: Benjamin Poirier <bpoirier@nvidia.com>
+
+[ Upstream commit bd60234222b2fd5573526da7bcd422801f271f5f ]
+
+Netdev drivers are expected to call dev_{uc,mc}_sync() in their
+ndo_set_rx_mode method and dev_{uc,mc}_unsync() in their ndo_stop method.
+This is mentioned in the kerneldoc for those dev_* functions.
+
+The team driver calls dev_{uc,mc}_unsync() during ndo_uninit instead of
+ndo_stop. This is ineffective because address lists (dev->{uc,mc}) have
+already been emptied in unregister_netdevice_many() before ndo_uninit is
+called. This mistake can result in addresses being leftover on former team
+ports after a team device has been deleted; see test_LAG_cleanup() in the
+last patch in this series.
+
+Add unsync calls at their expected location, team_close().
+
+v3:
+* When adding or deleting a port, only sync/unsync addresses if the team
+  device is up. In other cases, it is taken care of at the right time by
+  ndo_open/ndo_set_rx_mode/ndo_stop.
+
+Fixes: 3d249d4ca7d0 ("net: introduce ethernet teaming device")
+Signed-off-by: Benjamin Poirier <bpoirier@nvidia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/team/team.c | 24 ++++++++++++++++++------
+ 1 file changed, 18 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
+index 8a1e9dba1249..2410f08e2bb5 100644
+--- a/drivers/net/team/team.c
++++ b/drivers/net/team/team.c
+@@ -1280,10 +1280,12 @@ static int team_port_add(struct team *team, struct net_device *port_dev,
+               }
+       }
+-      netif_addr_lock_bh(dev);
+-      dev_uc_sync_multiple(port_dev, dev);
+-      dev_mc_sync_multiple(port_dev, dev);
+-      netif_addr_unlock_bh(dev);
++      if (dev->flags & IFF_UP) {
++              netif_addr_lock_bh(dev);
++              dev_uc_sync_multiple(port_dev, dev);
++              dev_mc_sync_multiple(port_dev, dev);
++              netif_addr_unlock_bh(dev);
++      }
+       port->index = -1;
+       list_add_tail_rcu(&port->list, &team->port_list);
+@@ -1354,8 +1356,10 @@ static int team_port_del(struct team *team, struct net_device *port_dev)
+       netdev_rx_handler_unregister(port_dev);
+       team_port_disable_netpoll(port);
+       vlan_vids_del_by_dev(port_dev, dev);
+-      dev_uc_unsync(port_dev, dev);
+-      dev_mc_unsync(port_dev, dev);
++      if (dev->flags & IFF_UP) {
++              dev_uc_unsync(port_dev, dev);
++              dev_mc_unsync(port_dev, dev);
++      }
+       dev_close(port_dev);
+       team_port_leave(team, port);
+@@ -1703,6 +1707,14 @@ static int team_open(struct net_device *dev)
+ static int team_close(struct net_device *dev)
+ {
++      struct team *team = netdev_priv(dev);
++      struct team_port *port;
++
++      list_for_each_entry(port, &team->port_list, list) {
++              dev_uc_unsync(port->dev, dev);
++              dev_mc_unsync(port->dev, dev);
++      }
++
+       return 0;
+ }
+-- 
+2.35.1
+
diff --git a/queue-4.19/netfilter-ebtables-fix-memory-leak-when-blob-is-malf.patch b/queue-4.19/netfilter-ebtables-fix-memory-leak-when-blob-is-malf.patch
new file mode 100644 (file)
index 0000000..9a4dcf4
--- /dev/null
@@ -0,0 +1,40 @@
+From c1cc88fc326665dca4e560f3a985538ff9986123 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Sep 2022 14:20:17 +0200
+Subject: netfilter: ebtables: fix memory leak when blob is malformed
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit 62ce44c4fff947eebdf10bb582267e686e6835c9 ]
+
+The bug fix was incomplete, it "replaced" crash with a memory leak.
+The old code had an assignment to "ret" embedded into the conditional,
+restore this.
+
+Fixes: 7997eff82828 ("netfilter: ebtables: reject blobs that don't provide all entry points")
+Reported-and-tested-by: syzbot+a24c5252f3e3ab733464@syzkaller.appspotmail.com
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bridge/netfilter/ebtables.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
+index ea27bacbd005..59d8974ee92b 100644
+--- a/net/bridge/netfilter/ebtables.c
++++ b/net/bridge/netfilter/ebtables.c
+@@ -1003,8 +1003,10 @@ static int do_replace_finish(struct net *net, struct ebt_replace *repl,
+               goto free_iterate;
+       }
+-      if (repl->valid_hooks != t->valid_hooks)
++      if (repl->valid_hooks != t->valid_hooks) {
++              ret = -EINVAL;
+               goto free_unlock;
++      }
+       if (repl->num_counters && repl->num_counters != t->private->nentries) {
+               ret = -EINVAL;
+-- 
+2.35.1
+
diff --git a/queue-4.19/netfilter-nf_conntrack_irc-tighten-matching-on-dcc-m.patch b/queue-4.19/netfilter-nf_conntrack_irc-tighten-matching-on-dcc-m.patch
new file mode 100644 (file)
index 0000000..ad587ac
--- /dev/null
@@ -0,0 +1,84 @@
+From 8ddbbb4d5aebbb9e3a106a0a0b61f8113b8b8ec3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Aug 2022 14:56:57 +1000
+Subject: netfilter: nf_conntrack_irc: Tighten matching on DCC message
+
+From: David Leadbeater <dgl@dgl.cx>
+
+[ Upstream commit e8d5dfd1d8747b56077d02664a8838c71ced948e ]
+
+CTCP messages should only be at the start of an IRC message, not
+anywhere within it.
+
+While the helper only decodes packes in the ORIGINAL direction, its
+possible to make a client send a CTCP message back by empedding one into
+a PING request.  As-is, thats enough to make the helper believe that it
+saw a CTCP message.
+
+Fixes: 869f37d8e48f ("[NETFILTER]: nf_conntrack/nf_nat: add IRC helper port")
+Signed-off-by: David Leadbeater <dgl@dgl.cx>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_conntrack_irc.c | 34 ++++++++++++++++++++++++++------
+ 1 file changed, 28 insertions(+), 6 deletions(-)
+
+diff --git a/net/netfilter/nf_conntrack_irc.c b/net/netfilter/nf_conntrack_irc.c
+index b7436935b57d..23ead02c6aa5 100644
+--- a/net/netfilter/nf_conntrack_irc.c
++++ b/net/netfilter/nf_conntrack_irc.c
+@@ -150,15 +150,37 @@ static int help(struct sk_buff *skb, unsigned int protoff,
+       data = ib_ptr;
+       data_limit = ib_ptr + skb->len - dataoff;
+-      /* strlen("\1DCC SENT t AAAAAAAA P\1\n")=24
+-       * 5+MINMATCHLEN+strlen("t AAAAAAAA P\1\n")=14 */
+-      while (data < data_limit - (19 + MINMATCHLEN)) {
+-              if (memcmp(data, "\1DCC ", 5)) {
++      /* Skip any whitespace */
++      while (data < data_limit - 10) {
++              if (*data == ' ' || *data == '\r' || *data == '\n')
++                      data++;
++              else
++                      break;
++      }
++
++      /* strlen("PRIVMSG x ")=10 */
++      if (data < data_limit - 10) {
++              if (strncasecmp("PRIVMSG ", data, 8))
++                      goto out;
++              data += 8;
++      }
++
++      /* strlen(" :\1DCC SENT t AAAAAAAA P\1\n")=26
++       * 7+MINMATCHLEN+strlen("t AAAAAAAA P\1\n")=26
++       */
++      while (data < data_limit - (21 + MINMATCHLEN)) {
++              /* Find first " :", the start of message */
++              if (memcmp(data, " :", 2)) {
+                       data++;
+                       continue;
+               }
++              data += 2;
++
++              /* then check that place only for the DCC command */
++              if (memcmp(data, "\1DCC ", 5))
++                      goto out;
+               data += 5;
+-              /* we have at least (19+MINMATCHLEN)-5 bytes valid data left */
++              /* we have at least (21+MINMATCHLEN)-(2+5) bytes valid data left */
+               iph = ip_hdr(skb);
+               pr_debug("DCC found in master %pI4:%u %pI4:%u\n",
+@@ -174,7 +196,7 @@ static int help(struct sk_buff *skb, unsigned int protoff,
+                       pr_debug("DCC %s detected\n", dccprotos[i]);
+                       /* we have at least
+-                       * (19+MINMATCHLEN)-5-dccprotos[i].matchlen bytes valid
++                       * (21+MINMATCHLEN)-7-dccprotos[i].matchlen bytes valid
+                        * data left (== 14/13 bytes) */
+                       if (parse_dcc(data, data_limit, &dcc_ip,
+                                      &dcc_port, &addr_beg_p, &addr_end_p)) {
+-- 
+2.35.1
+
diff --git a/queue-4.19/netfilter-nf_conntrack_sip-fix-ct_sip_walk_headers.patch b/queue-4.19/netfilter-nf_conntrack_sip-fix-ct_sip_walk_headers.patch
new file mode 100644 (file)
index 0000000..043c5b2
--- /dev/null
@@ -0,0 +1,60 @@
+From 9d859b06c6f74d8cd62936fc34e6a753662c9218 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Jun 2019 12:32:40 +0300
+Subject: netfilter: nf_conntrack_sip: fix ct_sip_walk_headers
+
+From: Igor Ryzhov <iryzhov@nfware.com>
+
+[ Upstream commit 39aebedeaaa95757f5c1f2ddb5f43fdddbf478ca ]
+
+ct_sip_next_header and ct_sip_get_header return an absolute
+value of matchoff, not a shift from current dataoff.
+So dataoff should be assigned matchoff, not incremented by it.
+
+This issue can be seen in the scenario when there are multiple
+Contact headers and the first one is using a hostname and other headers
+use IP addresses. In this case, ct_sip_walk_headers will work as follows:
+
+The first ct_sip_get_header call to will find the first Contact header
+but will return -1 as the header uses a hostname. But matchoff will
+be changed to the offset of this header. After that, dataoff should be
+set to matchoff, so that the next ct_sip_get_header call find the next
+Contact header. But instead of assigning dataoff to matchoff, it is
+incremented by it, which is not correct, as matchoff is an absolute
+value of the offset. So on the next call to the ct_sip_get_header,
+dataoff will be incorrect, and the next Contact header may not be
+found at all.
+
+Fixes: 05e3ced297fe ("[NETFILTER]: nf_conntrack_sip: introduce SIP-URI parsing helper")
+Signed-off-by: Igor Ryzhov <iryzhov@nfware.com>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_conntrack_sip.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c
+index c8d2b6688a2a..046f118dea06 100644
+--- a/net/netfilter/nf_conntrack_sip.c
++++ b/net/netfilter/nf_conntrack_sip.c
+@@ -471,7 +471,7 @@ static int ct_sip_walk_headers(const struct nf_conn *ct, const char *dptr,
+                               return ret;
+                       if (ret == 0)
+                               break;
+-                      dataoff += *matchoff;
++                      dataoff = *matchoff;
+               }
+               *in_header = 0;
+       }
+@@ -483,7 +483,7 @@ static int ct_sip_walk_headers(const struct nf_conn *ct, const char *dptr,
+                       break;
+               if (ret == 0)
+                       return ret;
+-              dataoff += *matchoff;
++              dataoff = *matchoff;
+       }
+       if (in_header)
+-- 
+2.35.1
+
diff --git a/queue-4.19/of-mdio-add-of_node_put-when-breaking-out-of-for_eac.patch b/queue-4.19/of-mdio-add-of_node_put-when-breaking-out-of-for_eac.patch
new file mode 100644 (file)
index 0000000..4566854
--- /dev/null
@@ -0,0 +1,38 @@
+From ff70cfc98eb36fe410fa09ffa66070745a428ef3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Sep 2022 20:56:59 +0800
+Subject: of: mdio: Add of_node_put() when breaking out of for_each_xx
+
+From: Liang He <windhl@126.com>
+
+[ Upstream commit 1c48709e6d9d353acaaac1d8e33474756b121d78 ]
+
+In of_mdiobus_register(), we should call of_node_put() for 'child'
+escaped out of for_each_available_child_of_node().
+
+Fixes: 66bdede495c7 ("of_mdio: Fix broken PHY IRQ in case of probe deferral")
+Co-developed-by: Miaoqian Lin <linmq006@gmail.com>
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Signed-off-by: Liang He <windhl@126.com>
+Link: https://lore.kernel.org/r/20220913125659.3331969-1-windhl@126.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/of/of_mdio.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/of/of_mdio.c b/drivers/of/of_mdio.c
+index 100adacfdca9..9031c57aa1b5 100644
+--- a/drivers/of/of_mdio.c
++++ b/drivers/of/of_mdio.c
+@@ -283,6 +283,7 @@ int of_mdiobus_register(struct mii_bus *mdio, struct device_node *np)
+       return 0;
+ unregister:
++      of_node_put(child);
+       mdiobus_unregister(mdio);
+       return rc;
+ }
+-- 
+2.35.1
+
diff --git a/queue-4.19/perf-jit-include-program-header-in-elf-files.patch b/queue-4.19/perf-jit-include-program-header-in-elf-files.patch
new file mode 100644 (file)
index 0000000..508d4bc
--- /dev/null
@@ -0,0 +1,86 @@
+From ab9efb0567090f1f4fae16d33c761780f3e19504 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Sep 2022 11:29:10 +0200
+Subject: perf jit: Include program header in ELF files
+
+From: Lieven Hey <lieven.hey@kdab.com>
+
+[ Upstream commit babd04386b1df8c364cdaa39ac0e54349502e1e5 ]
+
+The missing header makes it hard for programs like elfutils to open
+these files.
+
+Fixes: 2d86612aacb7805f ("perf symbol: Correct address for bss symbols")
+Reviewed-by: Leo Yan <leo.yan@linaro.org>
+Signed-off-by: Lieven Hey <lieven.hey@kdab.com>
+Tested-by: Leo Yan <leo.yan@linaro.org>
+Cc: Leo Yan <leo.yan@linaro.org>
+Link: https://lore.kernel.org/r/20220915092910.711036-1-lieven.hey@kdab.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/genelf.c | 14 ++++++++++++++
+ tools/perf/util/genelf.h |  4 ++++
+ 2 files changed, 18 insertions(+)
+
+diff --git a/tools/perf/util/genelf.c b/tools/perf/util/genelf.c
+index afb8fe3a8e35..65e41e259af8 100644
+--- a/tools/perf/util/genelf.c
++++ b/tools/perf/util/genelf.c
+@@ -256,6 +256,7 @@ jit_write_elf(int fd, uint64_t load_addr, const char *sym,
+       Elf_Data *d;
+       Elf_Scn *scn;
+       Elf_Ehdr *ehdr;
++      Elf_Phdr *phdr;
+       Elf_Shdr *shdr;
+       uint64_t eh_frame_base_offset;
+       char *strsym = NULL;
+@@ -290,6 +291,19 @@ jit_write_elf(int fd, uint64_t load_addr, const char *sym,
+       ehdr->e_version = EV_CURRENT;
+       ehdr->e_shstrndx= unwinding ? 4 : 2; /* shdr index for section name */
++      /*
++       * setup program header
++       */
++      phdr = elf_newphdr(e, 1);
++      phdr[0].p_type = PT_LOAD;
++      phdr[0].p_offset = 0;
++      phdr[0].p_vaddr = 0;
++      phdr[0].p_paddr = 0;
++      phdr[0].p_filesz = csize;
++      phdr[0].p_memsz = csize;
++      phdr[0].p_flags = PF_X | PF_R;
++      phdr[0].p_align = 8;
++
+       /*
+        * setup text section
+        */
+diff --git a/tools/perf/util/genelf.h b/tools/perf/util/genelf.h
+index de322d51c7fe..23a7401a63d0 100644
+--- a/tools/perf/util/genelf.h
++++ b/tools/perf/util/genelf.h
+@@ -41,8 +41,10 @@ int jit_add_debug_info(Elf *e, uint64_t code_addr, void *debug, int nr_debug_ent
+ #if GEN_ELF_CLASS == ELFCLASS64
+ #define elf_newehdr   elf64_newehdr
++#define elf_newphdr   elf64_newphdr
+ #define elf_getshdr   elf64_getshdr
+ #define Elf_Ehdr      Elf64_Ehdr
++#define Elf_Phdr      Elf64_Phdr
+ #define Elf_Shdr      Elf64_Shdr
+ #define Elf_Sym               Elf64_Sym
+ #define ELF_ST_TYPE(a)        ELF64_ST_TYPE(a)
+@@ -50,8 +52,10 @@ int jit_add_debug_info(Elf *e, uint64_t code_addr, void *debug, int nr_debug_ent
+ #define ELF_ST_VIS(a) ELF64_ST_VISIBILITY(a)
+ #else
+ #define elf_newehdr   elf32_newehdr
++#define elf_newphdr   elf32_newphdr
+ #define elf_getshdr   elf32_getshdr
+ #define Elf_Ehdr      Elf32_Ehdr
++#define Elf_Phdr      Elf32_Phdr
+ #define Elf_Shdr      Elf32_Shdr
+ #define Elf_Sym               Elf32_Sym
+ #define ELF_ST_TYPE(a)        ELF32_ST_TYPE(a)
+-- 
+2.35.1
+
diff --git a/queue-4.19/perf-kcore_copy-do-not-check-proc-modules-is-unchang.patch b/queue-4.19/perf-kcore_copy-do-not-check-proc-modules-is-unchang.patch
new file mode 100644 (file)
index 0000000..6e32786
--- /dev/null
@@ -0,0 +1,62 @@
+From 56ea5e0ea78a5b94d5ce3f4e17cc4e6e9a4d8ce9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Sep 2022 15:24:29 +0300
+Subject: perf kcore_copy: Do not check /proc/modules is unchanged
+
+From: Adrian Hunter <adrian.hunter@intel.com>
+
+[ Upstream commit 5b427df27b94aec1312cace48a746782a0925c53 ]
+
+/proc/kallsyms and /proc/modules are compared before and after the copy
+in order to ensure no changes during the copy.
+
+However /proc/modules also might change due to reference counts changing
+even though that does not make any difference.
+
+Any modules loaded or unloaded should be visible in changes to kallsyms,
+so it is not necessary to check /proc/modules also anyway.
+
+Remove the comparison checking that /proc/modules is unchanged.
+
+Fixes: fc1b691d7651d949 ("perf buildid-cache: Add ability to add kcore to the cache")
+Reported-by: Daniel Dao <dqminh@cloudflare.com>
+Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
+Tested-by: Daniel Dao <dqminh@cloudflare.com>
+Acked-by: Namhyung Kim <namhyung@kernel.org>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Link: https://lore.kernel.org/r/20220914122429.8770-1-adrian.hunter@intel.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/symbol-elf.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c
+index bd33d6613929..5fba57c10edd 100644
+--- a/tools/perf/util/symbol-elf.c
++++ b/tools/perf/util/symbol-elf.c
+@@ -1871,8 +1871,8 @@ static int kcore_copy__compare_file(const char *from_dir, const char *to_dir,
+  * unusual.  One significant peculiarity is that the mapping (start -> pgoff)
+  * is not the same for the kernel map and the modules map.  That happens because
+  * the data is copied adjacently whereas the original kcore has gaps.  Finally,
+- * kallsyms and modules files are compared with their copies to check that
+- * modules have not been loaded or unloaded while the copies were taking place.
++ * kallsyms file is compared with its copy to check that modules have not been
++ * loaded or unloaded while the copies were taking place.
+  *
+  * Return: %0 on success, %-1 on failure.
+  */
+@@ -1935,9 +1935,6 @@ int kcore_copy(const char *from_dir, const char *to_dir)
+                       goto out_extract_close;
+       }
+-      if (kcore_copy__compare_file(from_dir, to_dir, "modules"))
+-              goto out_extract_close;
+-
+       if (kcore_copy__compare_file(from_dir, to_dir, "kallsyms"))
+               goto out_extract_close;
+-- 
+2.35.1
+
index ad7d1cb81b0c39af934aec7466529dc2265bb835..443ceb6f87c83fe1447f7f6d0c001986c6696965 100644 (file)
@@ -31,3 +31,19 @@ alsa-hda-realtek-enable-4-speaker-output-dell-precision-5530-laptop.patch
 efi-libstub-check-shim-mode-using-moksbstatert.patch
 riscv-fix-a-nasty-sigreturn-bug.patch
 mm-slub-fix-to-return-errno-if-kmalloc-fails.patch
+arm64-dts-rockchip-set-rk3399-gru-pclk_edp-to-24-mhz.patch
+arm64-dts-rockchip-remove-enable-active-low-from-rk3.patch
+netfilter-nf_conntrack_sip-fix-ct_sip_walk_headers.patch
+netfilter-nf_conntrack_irc-tighten-matching-on-dcc-m.patch
+iavf-fix-cached-head-and-tail-value-for-iavf_get_tx_.patch
+ipvlan-fix-out-of-bound-bugs-caused-by-unset-skb-mac.patch
+net-team-unsync-device-addresses-on-ndo_stop.patch
+mips-lantiq-export-clk_get_io-for-lantiq_wdt.ko.patch
+i40e-fix-vf-set-max-mtu-size.patch
+i40e-fix-set-max_tx_rate-when-it-is-lower-than-1-mbp.patch
+of-mdio-add-of_node_put-when-breaking-out-of-for_eac.patch
+netfilter-ebtables-fix-memory-leak-when-blob-is-malf.patch
+can-gs_usb-gs_can_open-fix-race-dev-can.state-condit.patch
+perf-jit-include-program-header-in-elf-files.patch
+perf-kcore_copy-do-not-check-proc-modules-is-unchang.patch
+net-sunhme-fix-packet-reception-for-len-rx_copy_thre.patch