From: Greg Kroah-Hartman Date: Thu, 7 May 2020 16:39:12 +0000 (+0200) Subject: 4.4-stable patches X-Git-Tag: v4.4.223~36 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=01eeaa69ccbae616147bcf60a82fda3320c5b423;p=thirdparty%2Fkernel%2Fstable-queue.git 4.4-stable patches added patches: at803x-fix-reset-handling.patch ata-sata_dwc_460ex-remove-incorrect-locking.patch bna-add-missing-per-queue-ethtool-stat.patch bnxt-add-a-missing-rcu-synchronization.patch bnxt_en-remove-locking-around-txr-dev_state.patch brcmfmac-add-fallback-for-devices-that-do-not-report-per-chain-values.patch brcmfmac-restore-stopping-netdev-queue-when-bus-clogs-up.patch bridge-fix-problems-around-fdb-entries-pointing-to-the-bridge-device.patch cxgbi-fix-uninitialized-flowi6.patch cxl-fix-dar-check-use-region_id-instead-of-opencoding.patch et131x-fix-logical-vs-bitwise-check-in-et131x_tx_timeout.patch fq_codel-return-non-zero-qlen-in-class-dumps.patch gre-build-header-correctly-for-collect-metadata-tunnels.patch gre-do-not-assign-header_ops-in-collect-metadata-mode.patch gre-reject-gue-and-fou-in-collect-metadata-mode.patch hwrng-exynos-disable-runtime-pm-on-driver-unbind.patch l2tp-fix-use-after-free-during-module-unload.patch macvlan-fix-potential-use-after-free-for-broadcasts.patch macvtap-segmented-packet-is-consumed.patch mvpp2-use-correct-size-for-memset.patch net-axienet-fix-return-value-check-in-axienet_probe.patch net-bcmgenet-device-stats-are-unsigned-long.patch net-bcmgenet-fix-skb_len-in-bcmgenet_xmit_single.patch net-bcmsysport-device-stats-are-unsigned-long.patch net-bridge-don-t-increment-tx_dropped-in-br_do_proxy_arp.patch net-dsa-mv88e6xxx-enable-sa-learning-on-dsa-ports.patch net-dsa-mv88e6xxx-fix-port-vlan-maps.patch net-ehea-avoid-null-pointer-dereference.patch net-ep93xx_eth-do-not-crash-unloading-module.patch net-ethernet-davinci_emac-fix-devioctl-while-in-fixed-link.patch net-ethernet-davinci_emac-fix-platform_data-overwrite.patch net-ethernet-mvneta-remove-iff_unicast_flt-which-is-not-implemented.patch net-ethernet-stmmac-dwmac-generic-fix-probe-error-path.patch net-ethernet-stmmac-dwmac-rk-fix-probe-error-path.patch net-ethernet-stmmac-dwmac-sti-fix-probe-error-path.patch net-ethernet-ti-cpsw-fix-device-and-of_node-leaks.patch net-ethernet-ti-cpsw-fix-secondary-emac-probe-error-path.patch net-ethoc-fix-early-error-paths.patch net-hns-fix-device-reference-leaks.patch net-icmp6_send-should-use-dst-dev-to-determine-l3-domain.patch net-icmp_route_lookup-should-use-rt-dev-to-determine-l3-domain.patch net-macb-add-missing-free_netdev-on-error-in-macb_probe.patch net-macb-replace-macb_writel-call-by-queue_writel-to-update-queue-isr.patch net-mv643xx_eth-fix-packet-corruption-with-tso-and-tiny-unaligned-packets.patch net-mvneta-fix-trivial-cut-off-issue-in-mvneta_ethtool_update_stats.patch net-skbuff-remove-errornous-length-validation-in-skb_vlan_pop.patch net-vxlan-lwt-fix-vxlan-local-traffic.patch ovs-geneve-fix-rtnl-notifications-on-iface-deletion.patch ovs-gre-fix-rtnl-notifications-on-iface-deletion.patch ovs-vxlan-fix-rtnl-notifications-on-iface-deletion.patch pinctrl-tegra-correctly-check-the-supported-configuration.patch qdisc-fix-a-module-refcount-leak-in-qdisc_create_dflt.patch ravb-add-missing-free_irq-call-to-ravb_close.patch regulator-core-rely-on-regulator_dev_release-to-free-constraints.patch regulator-try-to-resolve-regulators-supplies-on-registration.patch rtnl-reset-calcit-fptr-in-rtnl_unregister.patch sfc-clear-napi_hash-state-when-copying-channels.patch sfc-fix-potential-stack-corruption-from-running-past-stat-bitmask.patch tipc-fix-the-error-handling-in-tipc_udp_enable.patch --- diff --git a/queue-4.4/at803x-fix-reset-handling.patch b/queue-4.4/at803x-fix-reset-handling.patch new file mode 100644 index 00000000000..35bbba0298a --- /dev/null +++ b/queue-4.4/at803x-fix-reset-handling.patch @@ -0,0 +1,52 @@ +From d57019d1858a6f9b3ca05d76d793466ae428cfa3 Mon Sep 17 00:00:00 2001 +From: Sergei Shtylyov +Date: Wed, 23 Mar 2016 00:44:40 +0300 +Subject: at803x: fix reset handling +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Sergei Shtylyov + +commit d57019d1858a6f9b3ca05d76d793466ae428cfa3 upstream. + +The driver of course "knows" that the chip's reset signal is active low, +so it drives the GPIO to 0 to reset the PHY and to 1 otherwise; however +all this will only work iff the GPIO is specified as active-high in the +device tree! I think both the driver and the device trees (if there are +any -- I was unable to find them) need to be fixed in this case... + +Fixes: 13a56b449325 ("net: phy: at803x: Add support for hardware reset") +Signed-off-by: Sergei Shtylyov +Acked-by: Uwe Kleine-König +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/phy/at803x.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/net/phy/at803x.c ++++ b/drivers/net/phy/at803x.c +@@ -198,7 +198,7 @@ static int at803x_probe(struct phy_devic + if (!priv) + return -ENOMEM; + +- gpiod_reset = devm_gpiod_get_optional(dev, "reset", GPIOD_OUT_HIGH); ++ gpiod_reset = devm_gpiod_get_optional(dev, "reset", GPIOD_OUT_LOW); + if (IS_ERR(gpiod_reset)) + return PTR_ERR(gpiod_reset); + +@@ -274,10 +274,10 @@ static void at803x_link_change_notify(st + + at803x_context_save(phydev, &context); + +- gpiod_set_value(priv->gpiod_reset, 0); +- msleep(1); + gpiod_set_value(priv->gpiod_reset, 1); + msleep(1); ++ gpiod_set_value(priv->gpiod_reset, 0); ++ msleep(1); + + at803x_context_restore(phydev, &context); + diff --git a/queue-4.4/ata-sata_dwc_460ex-remove-incorrect-locking.patch b/queue-4.4/ata-sata_dwc_460ex-remove-incorrect-locking.patch new file mode 100644 index 00000000000..1549f269d5b --- /dev/null +++ b/queue-4.4/ata-sata_dwc_460ex-remove-incorrect-locking.patch @@ -0,0 +1,115 @@ +From 55e610cdd28c0ad3dce0652030c0296d549673f3 Mon Sep 17 00:00:00 2001 +From: Mans Rullgard +Date: Tue, 26 Apr 2016 12:03:02 +0300 +Subject: ata: sata_dwc_460ex: remove incorrect locking + +From: Mans Rullgard + +commit 55e610cdd28c0ad3dce0652030c0296d549673f3 upstream. + +This lock is already taken in ata_scsi_queuecmd() a few levels up the +call stack so attempting to take it here is an error. Moreover, it is +pointless in the first place since it only protects a single, atomic +assignment. + +Enabling lock debugging gives the following output: + +============================================= +[ INFO: possible recursive locking detected ] +4.4.0-rc5+ #189 Not tainted +--------------------------------------------- +kworker/u2:3/37 is trying to acquire lock: + (&(&host->lock)->rlock){-.-...}, at: [<90283294>] sata_dwc_exec_command_by_tag.constprop.14+0x44/0x8c + +but task is already holding lock: + (&(&host->lock)->rlock){-.-...}, at: [<902761ac>] ata_scsi_queuecmd+0x2c/0x330 + +other info that might help us debug this: + Possible unsafe locking scenario: + + CPU0 + ---- + lock(&(&host->lock)->rlock); + lock(&(&host->lock)->rlock); + + *** DEADLOCK *** + May be due to missing lock nesting notation + +4 locks held by kworker/u2:3/37: + #0: ("events_unbound"){.+.+.+}, at: [<9003a0a4>] process_one_work+0x12c/0x430 + #1: ((&entry->work)){+.+.+.}, at: [<9003a0a4>] process_one_work+0x12c/0x430 + #2: (&bdev->bd_mutex){+.+.+.}, at: [<9011fd54>] __blkdev_get+0x50/0x380 + #3: (&(&host->lock)->rlock){-.-...}, at: [<902761ac>] ata_scsi_queuecmd+0x2c/0x330 + +stack backtrace: +CPU: 0 PID: 37 Comm: kworker/u2:3 Not tainted 4.4.0-rc5+ #189 +Workqueue: events_unbound async_run_entry_fn +Stack : 90b38e30 00000021 00000003 9b2a6040 00000000 9005f3f0 904fc8dc 00000025 + 906b96e4 00000000 90528648 9b3336c4 904fc8dc 9009bf18 00000002 00000004 + 00000000 00000000 9b3336c4 9b3336e4 904fc8dc 9003d074 00000000 90500000 + 9005e738 00000000 00000000 00000000 00000000 00000000 00000000 00000000 + 6e657665 755f7374 756f626e 0000646e 00000000 00000000 9b00ca00 9b025000 + ... +Call Trace: +[<90009d6c>] show_stack+0x88/0xa4 +[<90057744>] __lock_acquire+0x1ce8/0x2154 +[<900583e4>] lock_acquire+0x64/0x8c +[<9045ff10>] _raw_spin_lock_irqsave+0x54/0x78 +[<90283294>] sata_dwc_exec_command_by_tag.constprop.14+0x44/0x8c +[<90283484>] sata_dwc_qc_issue+0x1a8/0x24c +[<9026b39c>] ata_qc_issue+0x1f0/0x410 +[<90273c6c>] ata_scsi_translate+0xb4/0x200 +[<90276234>] ata_scsi_queuecmd+0xb4/0x330 +[<9025800c>] scsi_dispatch_cmd+0xd0/0x128 +[<90259934>] scsi_request_fn+0x58c/0x638 +[<901a3e50>] __blk_run_queue+0x40/0x5c +[<901a83d4>] blk_queue_bio+0x27c/0x28c +[<901a5914>] generic_make_request+0xf0/0x188 +[<901a5a54>] submit_bio+0xa8/0x194 +[<9011adcc>] submit_bh_wbc.isra.23+0x15c/0x17c +[<9011c908>] block_read_full_page+0x3e4/0x428 +[<9009e2e0>] do_read_cache_page+0xac/0x210 +[<9009fd90>] read_cache_page+0x18/0x24 +[<901bbd18>] read_dev_sector+0x38/0xb0 +[<901bd174>] msdos_partition+0xb4/0x5c0 +[<901bcb8c>] check_partition+0x140/0x274 +[<901bba60>] rescan_partitions+0xa0/0x2b0 +[<9011ff68>] __blkdev_get+0x264/0x380 +[<901201ac>] blkdev_get+0x128/0x36c +[<901b9378>] add_disk+0x3c0/0x4bc +[<90268268>] sd_probe_async+0x100/0x224 +[<90043a44>] async_run_entry_fn+0x50/0x124 +[<9003a11c>] process_one_work+0x1a4/0x430 +[<9003a4f4>] worker_thread+0x14c/0x4fc +[<900408f4>] kthread+0xd0/0xe8 +[<90004338>] ret_from_kernel_thread+0x14/0x1c + +Fixes: 62936009f35a ("[libata] Add 460EX on-chip SATA driver, sata_dwc_460ex") +Tested-by: Christian Lamparter +Signed-off-by: Mans Rullgard +Signed-off-by: Tejun Heo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/sata_dwc_460ex.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/drivers/ata/sata_dwc_460ex.c ++++ b/drivers/ata/sata_dwc_460ex.c +@@ -924,15 +924,13 @@ static void sata_dwc_exec_command_by_tag + struct ata_taskfile *tf, + u8 tag, u32 cmd_issued) + { +- unsigned long flags; + struct sata_dwc_device_port *hsdevp = HSDEVP_FROM_AP(ap); + + dev_dbg(ap->dev, "%s cmd(0x%02x): %s tag=%d\n", __func__, tf->command, + ata_get_cmd_descript(tf->command), tag); + +- spin_lock_irqsave(&ap->host->lock, flags); + hsdevp->cmd_issued[tag] = cmd_issued; +- spin_unlock_irqrestore(&ap->host->lock, flags); ++ + /* + * Clear SError before executing a new command. + * sata_dwc_scr_write and read can not be used here. Clearing the PM diff --git a/queue-4.4/bna-add-missing-per-queue-ethtool-stat.patch b/queue-4.4/bna-add-missing-per-queue-ethtool-stat.patch new file mode 100644 index 00000000000..539a6ebea9d --- /dev/null +++ b/queue-4.4/bna-add-missing-per-queue-ethtool-stat.patch @@ -0,0 +1,52 @@ +From 2835d2d9e366a2985b24051d228333bfba82f3a7 Mon Sep 17 00:00:00 2001 +From: Ivan Vecera +Date: Thu, 15 Sep 2016 22:47:51 +0200 +Subject: bna: add missing per queue ethtool stat + +From: Ivan Vecera + +commit 2835d2d9e366a2985b24051d228333bfba82f3a7 upstream. + +Commit ba5ca784 "bna: check for dma mapping errors" added besides other +things a statistic that counts number of DMA buffer mapping failures +per each Rx queue. This counter is not included in ethtool stats output. + +Fixes: ba5ca784 "bna: check for dma mapping errors" +Signed-off-by: Ivan Vecera +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/brocade/bna/bnad_ethtool.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/brocade/bna/bnad_ethtool.c ++++ b/drivers/net/ethernet/brocade/bna/bnad_ethtool.c +@@ -31,7 +31,7 @@ + #define BNAD_NUM_TXF_COUNTERS 12 + #define BNAD_NUM_RXF_COUNTERS 10 + #define BNAD_NUM_CQ_COUNTERS (3 + 5) +-#define BNAD_NUM_RXQ_COUNTERS 6 ++#define BNAD_NUM_RXQ_COUNTERS 7 + #define BNAD_NUM_TXQ_COUNTERS 5 + + #define BNAD_ETHTOOL_STATS_NUM \ +@@ -658,6 +658,8 @@ bnad_get_strings(struct net_device *netd + string += ETH_GSTRING_LEN; + sprintf(string, "rxq%d_allocbuf_failed", q_num); + string += ETH_GSTRING_LEN; ++ sprintf(string, "rxq%d_mapbuf_failed", q_num); ++ string += ETH_GSTRING_LEN; + sprintf(string, "rxq%d_producer_index", q_num); + string += ETH_GSTRING_LEN; + sprintf(string, "rxq%d_consumer_index", q_num); +@@ -678,6 +680,9 @@ bnad_get_strings(struct net_device *netd + sprintf(string, "rxq%d_allocbuf_failed", + q_num); + string += ETH_GSTRING_LEN; ++ sprintf(string, "rxq%d_mapbuf_failed", ++ q_num); ++ string += ETH_GSTRING_LEN; + sprintf(string, "rxq%d_producer_index", + q_num); + string += ETH_GSTRING_LEN; diff --git a/queue-4.4/bnxt-add-a-missing-rcu-synchronization.patch b/queue-4.4/bnxt-add-a-missing-rcu-synchronization.patch new file mode 100644 index 00000000000..8da15c99a18 --- /dev/null +++ b/queue-4.4/bnxt-add-a-missing-rcu-synchronization.patch @@ -0,0 +1,37 @@ +From e5f6f564fd191d365fcd775c06a732a488205588 Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Wed, 16 Nov 2016 06:31:52 -0800 +Subject: bnxt: add a missing rcu synchronization + +From: Eric Dumazet + +commit e5f6f564fd191d365fcd775c06a732a488205588 upstream. + +Add a missing synchronize_net() call to avoid potential use after free, +since we explicitly call napi_hash_del() to factorize the RCU grace +period. + +Fixes: c0c050c58d84 ("bnxt_en: New Broadcom ethernet driver.") +Signed-off-by: Eric Dumazet +Cc: Michael Chan +Acked-by: Michael Chan +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -4250,6 +4250,10 @@ static void bnxt_del_napi(struct bnxt *b + napi_hash_del(&bnapi->napi); + netif_napi_del(&bnapi->napi); + } ++ /* We called napi_hash_del() before netif_napi_del(), we need ++ * to respect an RCU grace period before freeing napi structures. ++ */ ++ synchronize_net(); + } + + static void bnxt_init_napi(struct bnxt *bp) diff --git a/queue-4.4/bnxt_en-remove-locking-around-txr-dev_state.patch b/queue-4.4/bnxt_en-remove-locking-around-txr-dev_state.patch new file mode 100644 index 00000000000..acd90c3232c --- /dev/null +++ b/queue-4.4/bnxt_en-remove-locking-around-txr-dev_state.patch @@ -0,0 +1,36 @@ +From cbce91cad4ee39070bf3c7873767194e4be88e16 Mon Sep 17 00:00:00 2001 +From: Florian Fainelli +Date: Mon, 18 Jul 2016 13:02:47 -0700 +Subject: bnxt_en: Remove locking around txr->dev_state + +From: Florian Fainelli + +commit cbce91cad4ee39070bf3c7873767194e4be88e16 upstream. + +txr->dev_state was not consistently manipulated with the acquisition of +the per-queue lock, after further inspection the lock does not seem +necessary, either the value is read as BNXT_DEV_STATE_CLOSING or 0. + +Reported-by: coverity (CID 1339583) +Fixes: c0c050c58d840 ("bnxt_en: New Broadcom ethernet driver.") +Signed-off-by: Florian Fainelli +Acked-by: Michael Chan +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 -- + 1 file changed, 2 deletions(-) + +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -4310,9 +4310,7 @@ static void bnxt_tx_disable(struct bnxt + bnapi = bp->bnapi[i]; + txr = &bnapi->tx_ring; + txq = netdev_get_tx_queue(bp->dev, i); +- __netif_tx_lock(txq, smp_processor_id()); + txr->dev_state = BNXT_DEV_STATE_CLOSING; +- __netif_tx_unlock(txq); + } + } + /* Stop all TX queues */ diff --git a/queue-4.4/brcmfmac-add-fallback-for-devices-that-do-not-report-per-chain-values.patch b/queue-4.4/brcmfmac-add-fallback-for-devices-that-do-not-report-per-chain-values.patch new file mode 100644 index 00000000000..72420ad7909 --- /dev/null +++ b/queue-4.4/brcmfmac-add-fallback-for-devices-that-do-not-report-per-chain-values.patch @@ -0,0 +1,60 @@ +From 94abd778a7bb00ed5d00f56d9fbfcbf5b7c02a5c Mon Sep 17 00:00:00 2001 +From: Jaap Jan Meijer +Date: Thu, 12 May 2016 18:25:08 +0200 +Subject: brcmfmac: add fallback for devices that do not report per-chain values + +From: Jaap Jan Meijer + +commit 94abd778a7bb00ed5d00f56d9fbfcbf5b7c02a5c upstream. + +If brcmf_cfg80211_get_station fails to determine the RSSI from the +per-chain values get the value individually as a fallback. + +Fixes: 1f0dc59a6de9 ("brcmfmac: rework .get_station() callback") +Signed-off-by: Jaap Jan Meijer +Acked-by: Arend van Spriel +Signed-off-by: Kalle Valo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +--- a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c ++++ b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c +@@ -2419,12 +2419,14 @@ brcmf_cfg80211_get_station(struct wiphy + const u8 *mac, struct station_info *sinfo) + { + struct brcmf_if *ifp = netdev_priv(ndev); ++ struct brcmf_scb_val_le scb_val; + s32 err = 0; + struct brcmf_sta_info_le sta_info_le; + u32 sta_flags; + u32 is_tdls_peer; + s32 total_rssi; + s32 count_rssi; ++ int rssi; + u32 i; + + brcmf_dbg(TRACE, "Enter, MAC %pM\n", mac); +@@ -2505,6 +2507,20 @@ brcmf_cfg80211_get_station(struct wiphy + sinfo->filled |= BIT(NL80211_STA_INFO_SIGNAL); + total_rssi /= count_rssi; + sinfo->signal = total_rssi; ++ } else if (test_bit(BRCMF_VIF_STATUS_CONNECTED, ++ &ifp->vif->sme_state)) { ++ memset(&scb_val, 0, sizeof(scb_val)); ++ err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_RSSI, ++ &scb_val, sizeof(scb_val)); ++ if (err) { ++ brcmf_err("Could not get rssi (%d)\n", err); ++ goto done; ++ } else { ++ rssi = le32_to_cpu(scb_val.val); ++ sinfo->filled |= BIT(NL80211_STA_INFO_SIGNAL); ++ sinfo->signal = rssi; ++ brcmf_dbg(CONN, "RSSI %d dBm\n", rssi); ++ } + } + } + done: diff --git a/queue-4.4/brcmfmac-restore-stopping-netdev-queue-when-bus-clogs-up.patch b/queue-4.4/brcmfmac-restore-stopping-netdev-queue-when-bus-clogs-up.patch new file mode 100644 index 00000000000..5169cedbb8d --- /dev/null +++ b/queue-4.4/brcmfmac-restore-stopping-netdev-queue-when-bus-clogs-up.patch @@ -0,0 +1,62 @@ +From 82bc9ab6a8f577d2174a736c33f3d4ecf7d9ef47 Mon Sep 17 00:00:00 2001 +From: Arend Van Spriel +Date: Fri, 15 Jul 2016 12:16:12 +0200 +Subject: brcmfmac: restore stopping netdev queue when bus clogs up +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Arend Van Spriel + +commit 82bc9ab6a8f577d2174a736c33f3d4ecf7d9ef47 upstream. + +When the host-interface bus has hard time handling transmit packets +it informs higher layer about this and it would stop the netdev +queue when needed. However, since commit 9cd18359d31e ("brcmfmac: +Make FWS queueing configurable.") this was broken. With this patch +the behaviour is restored. + +Cc: stable@vger.kernel.org # v4.5, v4.6, v4.7 +Fixes: 9cd18359d31e ("brcmfmac: Make FWS queueing configurable.") +Tested-by: Per Förlin +Reviewed-by: Hante Meuleman +Reviewed-by: Pieter-Paul Giesberts +Reviewed-by: Franky Lin +Signed-off-by: Arend van Spriel +Signed-off-by: Kalle Valo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c | 22 ++++++++++++++++----- + 1 file changed, 17 insertions(+), 5 deletions(-) + +--- a/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c ++++ b/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c +@@ -2262,10 +2262,22 @@ void brcmf_fws_bustxfail(struct brcmf_fw + void brcmf_fws_bus_blocked(struct brcmf_pub *drvr, bool flow_blocked) + { + struct brcmf_fws_info *fws = drvr->fws; ++ struct brcmf_if *ifp; ++ int i; + +- fws->bus_flow_blocked = flow_blocked; +- if (!flow_blocked) +- brcmf_fws_schedule_deq(fws); +- else +- fws->stats.bus_flow_block++; ++ if (fws->avoid_queueing) { ++ for (i = 0; i < BRCMF_MAX_IFS; i++) { ++ ifp = drvr->iflist[i]; ++ if (!ifp || !ifp->ndev) ++ continue; ++ brcmf_txflowblock_if(ifp, BRCMF_NETIF_STOP_REASON_FLOW, ++ flow_blocked); ++ } ++ } else { ++ fws->bus_flow_blocked = flow_blocked; ++ if (!flow_blocked) ++ brcmf_fws_schedule_deq(fws); ++ else ++ fws->stats.bus_flow_block++; ++ } + } diff --git a/queue-4.4/bridge-fix-problems-around-fdb-entries-pointing-to-the-bridge-device.patch b/queue-4.4/bridge-fix-problems-around-fdb-entries-pointing-to-the-bridge-device.patch new file mode 100644 index 00000000000..756e3b3b2ee --- /dev/null +++ b/queue-4.4/bridge-fix-problems-around-fdb-entries-pointing-to-the-bridge-device.patch @@ -0,0 +1,156 @@ +From 7bb90c3715a496c650b2e879225030f9dd9cfafb Mon Sep 17 00:00:00 2001 +From: Toshiaki Makita +Date: Thu, 4 Aug 2016 11:11:19 +0900 +Subject: bridge: Fix problems around fdb entries pointing to the bridge device + +From: Toshiaki Makita + +commit 7bb90c3715a496c650b2e879225030f9dd9cfafb upstream. + +Adding fdb entries pointing to the bridge device uses fdb_insert(), +which lacks various checks and does not respect added_by_user flag. + +As a result, some inconsistent behavior can happen: +* Adding temporary entries succeeds but results in permanent entries. +* Same goes for "dynamic" and "use". +* Changing mac address of the bridge device causes deletion of + user-added entries. +* Replacing existing entries looks successful from userspace but actually + not, regardless of NLM_F_EXCL flag. + +Use the same logic as other entries and fix them. + +Fixes: 3741873b4f73 ("bridge: allow adding of fdb entries pointing to the bridge device") +Signed-off-by: Toshiaki Makita +Acked-by: Roopa Prabhu +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/bridge/br_fdb.c | 52 +++++++++++++++++++++++++++------------------------- + 1 file changed, 27 insertions(+), 25 deletions(-) + +--- a/net/bridge/br_fdb.c ++++ b/net/bridge/br_fdb.c +@@ -266,7 +266,7 @@ void br_fdb_change_mac_address(struct ne + + /* If old entry was unassociated with any port, then delete it. */ + f = __br_fdb_get(br, br->dev->dev_addr, 0); +- if (f && f->is_local && !f->dst) ++ if (f && f->is_local && !f->dst && !f->added_by_user) + fdb_delete_local(br, NULL, f); + + fdb_insert(br, NULL, newaddr, 0); +@@ -281,7 +281,7 @@ void br_fdb_change_mac_address(struct ne + if (!br_vlan_should_use(v)) + continue; + f = __br_fdb_get(br, br->dev->dev_addr, v->vid); +- if (f && f->is_local && !f->dst) ++ if (f && f->is_local && !f->dst && !f->added_by_user) + fdb_delete_local(br, NULL, f); + fdb_insert(br, NULL, newaddr, v->vid); + } +@@ -758,20 +758,25 @@ out: + } + + /* Update (create or replace) forwarding database entry */ +-static int fdb_add_entry(struct net_bridge_port *source, const __u8 *addr, +- __u16 state, __u16 flags, __u16 vid) ++static int fdb_add_entry(struct net_bridge *br, struct net_bridge_port *source, ++ const __u8 *addr, __u16 state, __u16 flags, __u16 vid) + { +- struct net_bridge *br = source->br; + struct hlist_head *head = &br->hash[br_mac_hash(addr, vid)]; + struct net_bridge_fdb_entry *fdb; + bool modified = false; + + /* If the port cannot learn allow only local and static entries */ +- if (!(state & NUD_PERMANENT) && !(state & NUD_NOARP) && ++ if (source && !(state & NUD_PERMANENT) && !(state & NUD_NOARP) && + !(source->state == BR_STATE_LEARNING || + source->state == BR_STATE_FORWARDING)) + return -EPERM; + ++ if (!source && !(state & NUD_PERMANENT)) { ++ pr_info("bridge: RTM_NEWNEIGH %s without NUD_PERMANENT\n", ++ br->dev->name); ++ return -EINVAL; ++ } ++ + fdb = fdb_find(head, addr, vid); + if (fdb == NULL) { + if (!(flags & NLM_F_CREATE)) +@@ -826,22 +831,28 @@ static int fdb_add_entry(struct net_brid + return 0; + } + +-static int __br_fdb_add(struct ndmsg *ndm, struct net_bridge_port *p, +- const unsigned char *addr, u16 nlh_flags, u16 vid) ++static int __br_fdb_add(struct ndmsg *ndm, struct net_bridge *br, ++ struct net_bridge_port *p, const unsigned char *addr, ++ u16 nlh_flags, u16 vid) + { + int err = 0; + + if (ndm->ndm_flags & NTF_USE) { ++ if (!p) { ++ pr_info("bridge: RTM_NEWNEIGH %s with NTF_USE is not supported\n", ++ br->dev->name); ++ return -EINVAL; ++ } + local_bh_disable(); + rcu_read_lock(); +- br_fdb_update(p->br, p, addr, vid, true); ++ br_fdb_update(br, p, addr, vid, true); + rcu_read_unlock(); + local_bh_enable(); + } else { +- spin_lock_bh(&p->br->hash_lock); +- err = fdb_add_entry(p, addr, ndm->ndm_state, ++ spin_lock_bh(&br->hash_lock); ++ err = fdb_add_entry(br, p, addr, ndm->ndm_state, + nlh_flags, vid); +- spin_unlock_bh(&p->br->hash_lock); ++ spin_unlock_bh(&br->hash_lock); + } + + return err; +@@ -878,6 +889,7 @@ int br_fdb_add(struct ndmsg *ndm, struct + dev->name); + return -EINVAL; + } ++ br = p->br; + vg = nbp_vlan_group(p); + } + +@@ -889,15 +901,9 @@ int br_fdb_add(struct ndmsg *ndm, struct + } + + /* VID was specified, so use it. */ +- if (dev->priv_flags & IFF_EBRIDGE) +- err = br_fdb_insert(br, NULL, addr, vid); +- else +- err = __br_fdb_add(ndm, p, addr, nlh_flags, vid); ++ err = __br_fdb_add(ndm, br, p, addr, nlh_flags, vid); + } else { +- if (dev->priv_flags & IFF_EBRIDGE) +- err = br_fdb_insert(br, NULL, addr, 0); +- else +- err = __br_fdb_add(ndm, p, addr, nlh_flags, 0); ++ err = __br_fdb_add(ndm, br, p, addr, nlh_flags, 0); + if (err || !vg || !vg->num_vlans) + goto out; + +@@ -908,11 +914,7 @@ int br_fdb_add(struct ndmsg *ndm, struct + list_for_each_entry(v, &vg->vlan_list, vlist) { + if (!br_vlan_should_use(v)) + continue; +- if (dev->priv_flags & IFF_EBRIDGE) +- err = br_fdb_insert(br, NULL, addr, v->vid); +- else +- err = __br_fdb_add(ndm, p, addr, nlh_flags, +- v->vid); ++ err = __br_fdb_add(ndm, br, p, addr, nlh_flags, v->vid); + if (err) + goto out; + } diff --git a/queue-4.4/cxgbi-fix-uninitialized-flowi6.patch b/queue-4.4/cxgbi-fix-uninitialized-flowi6.patch new file mode 100644 index 00000000000..42aa0ae1018 --- /dev/null +++ b/queue-4.4/cxgbi-fix-uninitialized-flowi6.patch @@ -0,0 +1,32 @@ +From 3d6d30d60abb19ba9a20e53ce65b18a9c148fcd1 Mon Sep 17 00:00:00 2001 +From: Jiri Benc +Date: Fri, 22 Apr 2016 13:09:13 +0200 +Subject: cxgbi: fix uninitialized flowi6 + +From: Jiri Benc + +commit 3d6d30d60abb19ba9a20e53ce65b18a9c148fcd1 upstream. + +ip6_route_output looks into different fields in the passed flowi6 structure, +yet cxgbi passes garbage in nearly all those fields. Zero the structure out +first. + +Fixes: fc8d0590d9142 ("libcxgbi: Add ipv6 api to driver") +Signed-off-by: Jiri Benc +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/cxgbi/libcxgbi.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/scsi/cxgbi/libcxgbi.c ++++ b/drivers/scsi/cxgbi/libcxgbi.c +@@ -692,6 +692,7 @@ static struct rt6_info *find_route_ipv6( + { + struct flowi6 fl; + ++ memset(&fl, 0, sizeof(fl)); + if (saddr) + memcpy(&fl.saddr, saddr, sizeof(struct in6_addr)); + if (daddr) diff --git a/queue-4.4/cxl-fix-dar-check-use-region_id-instead-of-opencoding.patch b/queue-4.4/cxl-fix-dar-check-use-region_id-instead-of-opencoding.patch new file mode 100644 index 00000000000..ea12009878e --- /dev/null +++ b/queue-4.4/cxl-fix-dar-check-use-region_id-instead-of-opencoding.patch @@ -0,0 +1,46 @@ +From 3b1dbfa14f97188ec33fdfc7acb66bea59a3bb21 Mon Sep 17 00:00:00 2001 +From: "Aneesh Kumar K.V" +Date: Wed, 20 Apr 2016 03:59:47 -0400 +Subject: cxl: Fix DAR check & use REGION_ID instead of opencoding + +From: Aneesh Kumar K.V + +commit 3b1dbfa14f97188ec33fdfc7acb66bea59a3bb21 upstream. + +The current code will set _PAGE_USER to the access flags for any +fault address, because the ~ operation will be true for all address we +take a fault on. But setting _PAGE_USER also means that the fault will +be handled only if the page table have _PAGE_USER set. Hence there is +no security hole with the current code. + +Now if it is an user space access, then the change in this patch really +don't have an impact because we have (!ctx->kernel) set true +and we take the if condition true. + +Now kernel context created fault on an address in the kernel range +will result in a fault loop because we will not insert the +hash pte due to access and pte permission mismatch. This patch fix +the above issue. + +Fixes: f204e0b8cedd ("cxl: Driver code for powernv PCIe based cards for userspace access") +Reviewed-by: Andrew Donnellan +Acked-by: Ian Munsie +Signed-off-by: Aneesh Kumar K.V +Signed-off-by: Michael Ellerman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/misc/cxl/fault.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/misc/cxl/fault.c ++++ b/drivers/misc/cxl/fault.c +@@ -152,7 +152,7 @@ static void cxl_handle_page_fault(struct + access = _PAGE_PRESENT; + if (dsisr & CXL_PSL_DSISR_An_S) + access |= _PAGE_RW; +- if ((!ctx->kernel) || ~(dar & (1ULL << 63))) ++ if ((!ctx->kernel) || (REGION_ID(dar) == USER_REGION_ID)) + access |= _PAGE_USER; + + if (dsisr & DSISR_NOHPTE) diff --git a/queue-4.4/et131x-fix-logical-vs-bitwise-check-in-et131x_tx_timeout.patch b/queue-4.4/et131x-fix-logical-vs-bitwise-check-in-et131x_tx_timeout.patch new file mode 100644 index 00000000000..c96d1d56c82 --- /dev/null +++ b/queue-4.4/et131x-fix-logical-vs-bitwise-check-in-et131x_tx_timeout.patch @@ -0,0 +1,33 @@ +From de702da7a823ab0c4a1e53ed79a2695f0d453855 Mon Sep 17 00:00:00 2001 +From: Florian Fainelli +Date: Fri, 15 Jul 2016 16:40:22 -0700 +Subject: et131x: Fix logical vs bitwise check in et131x_tx_timeout() + +From: Florian Fainelli + +commit de702da7a823ab0c4a1e53ed79a2695f0d453855 upstream. + +We should be using a logical check here instead of a bitwise operation +to check if the device is closed already in et131x_tx_timeout(). + +Reported-by: coverity (CID 146498) +Fixes: 38df6492eb511 ("et131x: Add PCIe gigabit ethernet driver et131x to drivers/net") +Signed-off-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/agere/et131x.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/agere/et131x.c ++++ b/drivers/net/ethernet/agere/et131x.c +@@ -3854,7 +3854,7 @@ static void et131x_tx_timeout(struct net + unsigned long flags; + + /* If the device is closed, ignore the timeout */ +- if (~(adapter->flags & FMP_ADAPTER_INTERRUPT_IN_USE)) ++ if (!(adapter->flags & FMP_ADAPTER_INTERRUPT_IN_USE)) + return; + + /* Any nonrecoverable hardware error? diff --git a/queue-4.4/fq_codel-return-non-zero-qlen-in-class-dumps.patch b/queue-4.4/fq_codel-return-non-zero-qlen-in-class-dumps.patch new file mode 100644 index 00000000000..423ed10867f --- /dev/null +++ b/queue-4.4/fq_codel-return-non-zero-qlen-in-class-dumps.patch @@ -0,0 +1,35 @@ +From aafddbf0cffeb790f919436285328c762279b5d4 Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Mon, 6 Jun 2016 09:12:39 -0700 +Subject: fq_codel: return non zero qlen in class dumps + +From: Eric Dumazet + +commit aafddbf0cffeb790f919436285328c762279b5d4 upstream. + +We properly scan the flow list to count number of packets, +but John passed 0 to gnet_stats_copy_queue() so we report +a zero value to user space instead of the result. + +Fixes: 640158536632 ("net: sched: restrict use of qstats qlen") +Signed-off-by: Eric Dumazet +Cc: John Fastabend +Acked-by: John Fastabend +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/sched/sch_fq_codel.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/sched/sch_fq_codel.c ++++ b/net/sched/sch_fq_codel.c +@@ -588,7 +588,7 @@ static int fq_codel_dump_class_stats(str + qs.backlog = q->backlogs[idx]; + qs.drops = flow->dropped; + } +- if (gnet_stats_copy_queue(d, NULL, &qs, 0) < 0) ++ if (gnet_stats_copy_queue(d, NULL, &qs, qs.qlen) < 0) + return -1; + if (idx < q->flows_cnt) + return gnet_stats_copy_app(d, &xstats, sizeof(xstats)); diff --git a/queue-4.4/gre-build-header-correctly-for-collect-metadata-tunnels.patch b/queue-4.4/gre-build-header-correctly-for-collect-metadata-tunnels.patch new file mode 100644 index 00000000000..cfb73065f50 --- /dev/null +++ b/queue-4.4/gre-build-header-correctly-for-collect-metadata-tunnels.patch @@ -0,0 +1,64 @@ +From 2090714e1d6e80979dd6926be22b0de9ca432273 Mon Sep 17 00:00:00 2001 +From: Jiri Benc +Date: Wed, 27 Apr 2016 11:29:07 +0200 +Subject: gre: build header correctly for collect metadata tunnels + +From: Jiri Benc + +commit 2090714e1d6e80979dd6926be22b0de9ca432273 upstream. + +In ipgre (i.e. not gretap) + collect metadata mode, the skb was assumed to +contain Ethernet header and was encapsulated as ETH_P_TEB. This is not the +case, the interface is ARPHRD_IPGRE and the protocol to be used for +encapsulation is skb->protocol. + +Fixes: 2e15ea390e6f4 ("ip_gre: Add support to collect tunnel metadata.") +Signed-off-by: Jiri Benc +Acked-by: Pravin B Shelar +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/ipv4/ip_gre.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +--- a/net/ipv4/ip_gre.c ++++ b/net/ipv4/ip_gre.c +@@ -520,7 +520,8 @@ static struct rtable *gre_get_rt(struct + return ip_route_output_key(net, fl); + } + +-static void gre_fb_xmit(struct sk_buff *skb, struct net_device *dev) ++static void gre_fb_xmit(struct sk_buff *skb, struct net_device *dev, ++ __be16 proto) + { + struct ip_tunnel_info *tun_info; + const struct ip_tunnel_key *key; +@@ -563,7 +564,7 @@ static void gre_fb_xmit(struct sk_buff * + } + + flags = tun_info->key.tun_flags & (TUNNEL_CSUM | TUNNEL_KEY); +- build_header(skb, tunnel_hlen, flags, htons(ETH_P_TEB), ++ build_header(skb, tunnel_hlen, flags, proto, + tunnel_id_to_key(tun_info->key.tun_id), 0); + + df = key->tun_flags & TUNNEL_DONT_FRAGMENT ? htons(IP_DF) : 0; +@@ -605,7 +606,7 @@ static netdev_tx_t ipgre_xmit(struct sk_ + const struct iphdr *tnl_params; + + if (tunnel->collect_md) { +- gre_fb_xmit(skb, dev); ++ gre_fb_xmit(skb, dev, skb->protocol); + return NETDEV_TX_OK; + } + +@@ -649,7 +650,7 @@ static netdev_tx_t gre_tap_xmit(struct s + struct ip_tunnel *tunnel = netdev_priv(dev); + + if (tunnel->collect_md) { +- gre_fb_xmit(skb, dev); ++ gre_fb_xmit(skb, dev, htons(ETH_P_TEB)); + return NETDEV_TX_OK; + } + diff --git a/queue-4.4/gre-do-not-assign-header_ops-in-collect-metadata-mode.patch b/queue-4.4/gre-do-not-assign-header_ops-in-collect-metadata-mode.patch new file mode 100644 index 00000000000..5946590d4df --- /dev/null +++ b/queue-4.4/gre-do-not-assign-header_ops-in-collect-metadata-mode.patch @@ -0,0 +1,56 @@ +From a64b04d86d14c81f50f68e102f79ef301e3d0a0e Mon Sep 17 00:00:00 2001 +From: Jiri Benc +Date: Wed, 27 Apr 2016 11:29:06 +0200 +Subject: gre: do not assign header_ops in collect metadata mode + +From: Jiri Benc + +commit a64b04d86d14c81f50f68e102f79ef301e3d0a0e upstream. + +In ipgre mode (i.e. not gretap) with collect metadata flag set, the tunnel +is incorrectly assumed to be mGRE in NBMA mode (see commit 6a5f44d7a048c). +This is not the case, we're controlling the encapsulation addresses by +lwtunnel metadata. And anyway, assigning dev->header_ops in collect metadata +mode does not make sense. + +Although it would be more user firendly to reject requests that specify +both the collect metadata flag and a remote/local IP address, this would +break current users of gretap or introduce ugly code and differences in +handling ipgre and gretap configuration. Keep the current behavior of +remote/local IP address being ignored in such case. + +v3: Back to v1, added explanation paragraph. +v2: Reject configuration specifying both remote/local address and collect + metadata flag. + +Fixes: 2e15ea390e6f4 ("ip_gre: Add support to collect tunnel metadata.") +Signed-off-by: Jiri Benc +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/ipv4/ip_gre.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/net/ipv4/ip_gre.c ++++ b/net/ipv4/ip_gre.c +@@ -882,7 +882,7 @@ static int ipgre_tunnel_init(struct net_ + netif_keep_dst(dev); + dev->addr_len = 4; + +- if (iph->daddr) { ++ if (iph->daddr && !tunnel->collect_md) { + #ifdef CONFIG_NET_IPGRE_BROADCAST + if (ipv4_is_multicast(iph->daddr)) { + if (!iph->saddr) +@@ -891,8 +891,9 @@ static int ipgre_tunnel_init(struct net_ + dev->header_ops = &ipgre_header_ops; + } + #endif +- } else ++ } else if (!tunnel->collect_md) { + dev->header_ops = &ipgre_header_ops; ++ } + + return ip_tunnel_init(dev); + } diff --git a/queue-4.4/gre-reject-gue-and-fou-in-collect-metadata-mode.patch b/queue-4.4/gre-reject-gue-and-fou-in-collect-metadata-mode.patch new file mode 100644 index 00000000000..9c60e18dff3 --- /dev/null +++ b/queue-4.4/gre-reject-gue-and-fou-in-collect-metadata-mode.patch @@ -0,0 +1,43 @@ +From 946b636f1730c64e05ff7fe8cf7136422fa8ea70 Mon Sep 17 00:00:00 2001 +From: Jiri Benc +Date: Wed, 27 Apr 2016 14:08:01 +0200 +Subject: gre: reject GUE and FOU in collect metadata mode + +From: Jiri Benc + +commit 946b636f1730c64e05ff7fe8cf7136422fa8ea70 upstream. + +The collect metadata mode does not support GUE nor FOU. This might be +implemented later; until then, we should reject such config. + +I think this is okay to be changed. It's unlikely anyone has such +configuration (as it doesn't work anyway) and we may need a way to +distinguish whether it's supported or not by the kernel later. + +For backwards compatibility with iproute2, it's not possible to just check +the attribute presence (iproute2 always includes the attribute), the actual +value has to be checked, too. + +Fixes: 2e15ea390e6f4 ("ip_gre: Add support to collect tunnel metadata.") +Signed-off-by: Jiri Benc +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/ipv4/ip_gre.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/net/ipv4/ip_gre.c ++++ b/net/ipv4/ip_gre.c +@@ -937,6 +937,11 @@ static int ipgre_tunnel_validate(struct + if (flags & (GRE_VERSION|GRE_ROUTING)) + return -EINVAL; + ++ if (data[IFLA_GRE_COLLECT_METADATA] && ++ data[IFLA_GRE_ENCAP_TYPE] && ++ nla_get_u16(data[IFLA_GRE_ENCAP_TYPE]) != TUNNEL_ENCAP_NONE) ++ return -EINVAL; ++ + return 0; + } + diff --git a/queue-4.4/hwrng-exynos-disable-runtime-pm-on-driver-unbind.patch b/queue-4.4/hwrng-exynos-disable-runtime-pm-on-driver-unbind.patch new file mode 100644 index 00000000000..c9eb50a2972 --- /dev/null +++ b/queue-4.4/hwrng-exynos-disable-runtime-pm-on-driver-unbind.patch @@ -0,0 +1,47 @@ +From 27d80fa8bccf8d28bef4f89709638efc624fef9a Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Mon, 14 Mar 2016 09:07:15 +0900 +Subject: hwrng: exynos - Disable runtime PM on driver unbind + +From: Krzysztof Kozlowski + +commit 27d80fa8bccf8d28bef4f89709638efc624fef9a upstream. + +Driver enabled runtime PM but did not revert this on removal. Re-binding +of a device triggered warning: + exynos-rng 10830400.rng: Unbalanced pm_runtime_enable! + +Fixes: b329669ea0b5 ("hwrng: exynos - Add support for Exynos random number generator") +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/hw_random/exynos-rng.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/drivers/char/hw_random/exynos-rng.c ++++ b/drivers/char/hw_random/exynos-rng.c +@@ -155,6 +155,14 @@ static int exynos_rng_probe(struct platf + return ret; + } + ++static int exynos_rng_remove(struct platform_device *pdev) ++{ ++ pm_runtime_dont_use_autosuspend(&pdev->dev); ++ pm_runtime_disable(&pdev->dev); ++ ++ return 0; ++} ++ + static int __maybe_unused exynos_rng_runtime_suspend(struct device *dev) + { + struct platform_device *pdev = to_platform_device(dev); +@@ -212,6 +220,7 @@ static struct platform_driver exynos_rng + .of_match_table = exynos_rng_dt_match, + }, + .probe = exynos_rng_probe, ++ .remove = exynos_rng_remove, + }; + + module_platform_driver(exynos_rng_driver); diff --git a/queue-4.4/l2tp-fix-use-after-free-during-module-unload.patch b/queue-4.4/l2tp-fix-use-after-free-during-module-unload.patch new file mode 100644 index 00000000000..1a4e7238afb --- /dev/null +++ b/queue-4.4/l2tp-fix-use-after-free-during-module-unload.patch @@ -0,0 +1,43 @@ +From 2f86953e7436c9b9a4690909c5e2db24799e173b Mon Sep 17 00:00:00 2001 +From: Sabrina Dubroca +Date: Fri, 2 Sep 2016 10:22:54 +0200 +Subject: l2tp: fix use-after-free during module unload + +From: Sabrina Dubroca + +commit 2f86953e7436c9b9a4690909c5e2db24799e173b upstream. + +Tunnel deletion is delayed by both a workqueue (l2tp_tunnel_delete -> wq + -> l2tp_tunnel_del_work) and RCU (sk_destruct -> RCU -> +l2tp_tunnel_destruct). + +By the time l2tp_tunnel_destruct() runs to destroy the tunnel and finish +destroying the socket, the private data reserved via the net_generic +mechanism has already been freed, but l2tp_tunnel_destruct() actually +uses this data. + +Make sure tunnel deletion for the netns has completed before returning +from l2tp_exit_net() by first flushing the tunnel removal workqueue, and +then waiting for RCU callbacks to complete. + +Fixes: 167eb17e0b17 ("l2tp: create tunnel sockets in the right namespace") +Signed-off-by: Sabrina Dubroca +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/l2tp/l2tp_core.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/net/l2tp/l2tp_core.c ++++ b/net/l2tp/l2tp_core.c +@@ -1953,6 +1953,9 @@ static __net_exit void l2tp_exit_net(str + l2tp_tunnel_delete(tunnel); + } + rcu_read_unlock_bh(); ++ ++ flush_workqueue(l2tp_wq); ++ rcu_barrier(); + } + + static struct pernet_operations l2tp_net_ops = { diff --git a/queue-4.4/macvlan-fix-potential-use-after-free-for-broadcasts.patch b/queue-4.4/macvlan-fix-potential-use-after-free-for-broadcasts.patch new file mode 100644 index 00000000000..34b420d1233 --- /dev/null +++ b/queue-4.4/macvlan-fix-potential-use-after-free-for-broadcasts.patch @@ -0,0 +1,69 @@ +From 260916dfb48c374f7840f3b86e69afd3afdb6e96 Mon Sep 17 00:00:00 2001 +From: Herbert Xu +Date: Wed, 1 Jun 2016 11:43:00 +0800 +Subject: macvlan: Fix potential use-after free for broadcasts + +From: Herbert Xu + +commit 260916dfb48c374f7840f3b86e69afd3afdb6e96 upstream. + +When we postpone a broadcast packet we save the source port in +the skb if it is local. However, the source port can disappear +before we get a chance to process the packet. + +This patch fixes this by holding a ref count on the netdev. + +It also delays the skb->cb modification until after we allocate +the new skb as you should not modify shared skbs. + +Fixes: 412ca1550cbe ("macvlan: Move broadcasts into a work queue") +Signed-off-by: Herbert Xu +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/macvlan.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +--- a/drivers/net/macvlan.c ++++ b/drivers/net/macvlan.c +@@ -305,6 +305,8 @@ static void macvlan_process_broadcast(st + + rcu_read_unlock(); + ++ if (src) ++ dev_put(src->dev); + kfree_skb(skb); + + cond_resched(); +@@ -312,6 +314,7 @@ static void macvlan_process_broadcast(st + } + + static void macvlan_broadcast_enqueue(struct macvlan_port *port, ++ const struct macvlan_dev *src, + struct sk_buff *skb) + { + struct sk_buff *nskb; +@@ -321,8 +324,12 @@ static void macvlan_broadcast_enqueue(st + if (!nskb) + goto err; + ++ MACVLAN_SKB_CB(nskb)->src = src; ++ + spin_lock(&port->bc_queue.lock); + if (skb_queue_len(&port->bc_queue) < MACVLAN_BC_QUEUE_LEN) { ++ if (src) ++ dev_hold(src->dev); + __skb_queue_tail(&port->bc_queue, nskb); + err = 0; + } +@@ -432,8 +439,7 @@ static rx_handler_result_t macvlan_handl + goto out; + } + +- MACVLAN_SKB_CB(skb)->src = src; +- macvlan_broadcast_enqueue(port, skb); ++ macvlan_broadcast_enqueue(port, src, skb); + + return RX_HANDLER_PASS; + } diff --git a/queue-4.4/macvtap-segmented-packet-is-consumed.patch b/queue-4.4/macvtap-segmented-packet-is-consumed.patch new file mode 100644 index 00000000000..caadba453a8 --- /dev/null +++ b/queue-4.4/macvtap-segmented-packet-is-consumed.patch @@ -0,0 +1,35 @@ +From be0bd3160165e42783d8215f426e41c07179c08a Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Fri, 6 May 2016 05:58:21 -0700 +Subject: macvtap: segmented packet is consumed + +From: Eric Dumazet + +commit be0bd3160165e42783d8215f426e41c07179c08a upstream. + +If GSO packet is segmented and its segments are properly queued, +we call consume_skb() instead of kfree_skb() to be drop monitor +friendly. + +Fixes: 3e4f8b7873709 ("macvtap: Perform GSO on forwarding path.") +Signed-off-by: Eric Dumazet +Cc: Vlad Yasevich +Reviewed-by: Shmulik Ladkani +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/macvtap.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/macvtap.c ++++ b/drivers/net/macvtap.c +@@ -373,7 +373,7 @@ static rx_handler_result_t macvtap_handl + goto wake_up; + } + +- kfree_skb(skb); ++ consume_skb(skb); + while (segs) { + struct sk_buff *nskb = segs->next; + diff --git a/queue-4.4/mvpp2-use-correct-size-for-memset.patch b/queue-4.4/mvpp2-use-correct-size-for-memset.patch new file mode 100644 index 00000000000..29f22ca5383 --- /dev/null +++ b/queue-4.4/mvpp2-use-correct-size-for-memset.patch @@ -0,0 +1,41 @@ +From e8f967c3d88489fc1562a31d4e44d905ac1d3aff Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Thu, 24 Nov 2016 17:28:12 +0100 +Subject: mvpp2: use correct size for memset + +From: Arnd Bergmann + +commit e8f967c3d88489fc1562a31d4e44d905ac1d3aff upstream. + +gcc-7 detects a short memset in mvpp2, introduced in the original +merge of the driver: + +drivers/net/ethernet/marvell/mvpp2.c: In function 'mvpp2_cls_init': +drivers/net/ethernet/marvell/mvpp2.c:3296:2: error: 'memset' used with length equal to number of elements without multiplication by element size [-Werror=memset-elt-size] + +The result seems to be that we write uninitialized data into the +flow table registers, although we did not get any warning about +that uninitialized data usage. + +Using sizeof() lets us initialize then entire array instead. + +Fixes: 3f518509dedc ("ethernet: Add new driver for Marvell Armada 375 network unit") +Signed-off-by: Arnd Bergmann +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/marvell/mvpp2.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/marvell/mvpp2.c ++++ b/drivers/net/ethernet/marvell/mvpp2.c +@@ -3305,7 +3305,7 @@ static void mvpp2_cls_init(struct mvpp2 + mvpp2_write(priv, MVPP2_CLS_MODE_REG, MVPP2_CLS_MODE_ACTIVE_MASK); + + /* Clear classifier flow table */ +- memset(&fe.data, 0, MVPP2_CLS_FLOWS_TBL_DATA_WORDS); ++ memset(&fe.data, 0, sizeof(fe.data)); + for (index = 0; index < MVPP2_CLS_FLOWS_TBL_SIZE; index++) { + fe.index = index; + mvpp2_cls_flow_write(priv, &fe); diff --git a/queue-4.4/net-axienet-fix-return-value-check-in-axienet_probe.patch b/queue-4.4/net-axienet-fix-return-value-check-in-axienet_probe.patch new file mode 100644 index 00000000000..d6b03a19dd2 --- /dev/null +++ b/queue-4.4/net-axienet-fix-return-value-check-in-axienet_probe.patch @@ -0,0 +1,36 @@ +From 3ad7b1477ef9b01988ac052b02be9cd410c95157 Mon Sep 17 00:00:00 2001 +From: Wei Yongjun +Date: Tue, 19 Jul 2016 11:23:24 +0000 +Subject: net: axienet: Fix return value check in axienet_probe() + +From: Wei Yongjun + +commit 3ad7b1477ef9b01988ac052b02be9cd410c95157 upstream. + +In case of error, the function of_parse_phandle() returns NULL +pointer not ERR_PTR(). The IS_ERR() test in the return value +check should be replaced with NULL test. + +Fixes: 46aa27df8853 ('net: axienet: Use devm_* calls') +Signed-off-by: Wei Yongjun +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c ++++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c +@@ -1602,9 +1602,9 @@ static int axienet_probe(struct platform + + /* Find the DMA node, map the DMA registers, and decode the DMA IRQs */ + np = of_parse_phandle(pdev->dev.of_node, "axistream-connected", 0); +- if (IS_ERR(np)) { ++ if (!np) { + dev_err(&pdev->dev, "could not find DMA node\n"); +- ret = PTR_ERR(np); ++ ret = -ENODEV; + goto free_netdev; + } + ret = of_address_to_resource(np, 0, &dmares); diff --git a/queue-4.4/net-bcmgenet-device-stats-are-unsigned-long.patch b/queue-4.4/net-bcmgenet-device-stats-are-unsigned-long.patch new file mode 100644 index 00000000000..a6b96e59d1e --- /dev/null +++ b/queue-4.4/net-bcmgenet-device-stats-are-unsigned-long.patch @@ -0,0 +1,36 @@ +From 6517eb59b03965689e6bb16bb2d480096b3ef95d Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Fri, 15 Apr 2016 10:47:52 -0700 +Subject: net: bcmgenet: device stats are unsigned long + +From: Eric Dumazet + +commit 6517eb59b03965689e6bb16bb2d480096b3ef95d upstream. + +On 64bit kernels, device stats are 64bit wide, not 32bit. + +Fixes: 1c1008c793fa4 ("net: bcmgenet: add main driver file") +Signed-off-by: Eric Dumazet +Cc: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/broadcom/genet/bcmgenet.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c ++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c +@@ -927,7 +927,11 @@ static void bcmgenet_get_ethtool_stats(s + else + p = (char *)priv; + p += s->stat_offset; +- data[i] = *(u32 *)p; ++ if (sizeof(unsigned long) != sizeof(u32) && ++ s->stat_sizeof == sizeof(unsigned long)) ++ data[i] = *(unsigned long *)p; ++ else ++ data[i] = *(u32 *)p; + } + } + diff --git a/queue-4.4/net-bcmgenet-fix-skb_len-in-bcmgenet_xmit_single.patch b/queue-4.4/net-bcmgenet-fix-skb_len-in-bcmgenet_xmit_single.patch new file mode 100644 index 00000000000..cc4b663d55e --- /dev/null +++ b/queue-4.4/net-bcmgenet-fix-skb_len-in-bcmgenet_xmit_single.patch @@ -0,0 +1,45 @@ +From 7dd399130efb5a454daf24075b7563d197114e39 Mon Sep 17 00:00:00 2001 +From: Petri Gynther +Date: Thu, 24 Mar 2016 11:27:21 -0700 +Subject: net: bcmgenet: fix skb_len in bcmgenet_xmit_single() + +From: Petri Gynther + +commit 7dd399130efb5a454daf24075b7563d197114e39 upstream. + +skb_len needs to be skb_headlen(skb) in bcmgenet_xmit_single(). + +Fragmented skbs can have only Ethernet + IP + TCP headers (14+20+20=54 bytes) +in the linear buffer, followed by the rest in fragments. Bumping skb_len to +ETH_ZLEN would be incorrect for this case, as it would introduce garbage +between TCP header and the fragment data. + +This also works with regular/non-fragmented small packets < ETH_ZLEN bytes. +Successfully tested this on GENETv3 with 42-byte ARP frames. + +For testing, I used: +ethtool -K eth0 tx-checksum-ipv4 off +ethtool -K eth0 tx-checksum-ipv6 off +echo 0 > /proc/sys/net/ipv4/tcp_timestamps + +Fixes: 1c1008c793fa ("net: bcmgenet: add main driver file") +Signed-off-by: Petri Gynther +Acked-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/broadcom/genet/bcmgenet.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c ++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c +@@ -1346,7 +1346,7 @@ static int bcmgenet_xmit_single(struct n + + tx_cb_ptr->skb = skb; + +- skb_len = skb_headlen(skb) < ETH_ZLEN ? ETH_ZLEN : skb_headlen(skb); ++ skb_len = skb_headlen(skb); + + mapping = dma_map_single(kdev, skb->data, skb_len, DMA_TO_DEVICE); + ret = dma_mapping_error(kdev, mapping); diff --git a/queue-4.4/net-bcmsysport-device-stats-are-unsigned-long.patch b/queue-4.4/net-bcmsysport-device-stats-are-unsigned-long.patch new file mode 100644 index 00000000000..3931f47b2ca --- /dev/null +++ b/queue-4.4/net-bcmsysport-device-stats-are-unsigned-long.patch @@ -0,0 +1,31 @@ +From 016eb55157166132b094e53434748cae35e18455 Mon Sep 17 00:00:00 2001 +From: Florian Fainelli +Date: Thu, 30 Jun 2016 13:27:20 -0700 +Subject: net: bcmsysport: Device stats are unsigned long + +From: Florian Fainelli + +commit 016eb55157166132b094e53434748cae35e18455 upstream. + +On 64bits kernels, device stats are 64bits wide, not 32bits. + +Fixes: 80105befdb4b ("net: systemport: add Broadcom SYSTEMPORT Ethernet MAC driver") +Signed-off-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/broadcom/bcmsysport.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/broadcom/bcmsysport.c ++++ b/drivers/net/ethernet/broadcom/bcmsysport.c +@@ -396,7 +396,7 @@ static void bcm_sysport_get_stats(struct + else + p = (char *)priv; + p += s->stat_offset; +- data[i] = *(u32 *)p; ++ data[i] = *(unsigned long *)p; + } + } + diff --git a/queue-4.4/net-bridge-don-t-increment-tx_dropped-in-br_do_proxy_arp.patch b/queue-4.4/net-bridge-don-t-increment-tx_dropped-in-br_do_proxy_arp.patch new file mode 100644 index 00000000000..4091e5e6970 --- /dev/null +++ b/queue-4.4/net-bridge-don-t-increment-tx_dropped-in-br_do_proxy_arp.patch @@ -0,0 +1,44 @@ +From 85a3d4a9356b595d5440c3f1bf07ee7cecca1567 Mon Sep 17 00:00:00 2001 +From: Nikolay Aleksandrov +Date: Tue, 30 Aug 2016 17:44:29 +0200 +Subject: net: bridge: don't increment tx_dropped in br_do_proxy_arp + +From: Nikolay Aleksandrov + +commit 85a3d4a9356b595d5440c3f1bf07ee7cecca1567 upstream. + +pskb_may_pull may fail due to various reasons (e.g. alloc failure), but the +skb isn't changed/dropped and processing continues so we shouldn't +increment tx_dropped. + +CC: Kyeyoon Park +CC: Roopa Prabhu +CC: Stephen Hemminger +CC: bridge@lists.linux-foundation.org +Fixes: 958501163ddd ("bridge: Add support for IEEE 802.11 Proxy ARP") +Signed-off-by: Nikolay Aleksandrov +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/bridge/br_input.c | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +--- a/net/bridge/br_input.c ++++ b/net/bridge/br_input.c +@@ -78,13 +78,10 @@ static void br_do_proxy_arp(struct sk_bu + + BR_INPUT_SKB_CB(skb)->proxyarp_replied = false; + +- if (dev->flags & IFF_NOARP) ++ if ((dev->flags & IFF_NOARP) || ++ !pskb_may_pull(skb, arp_hdr_len(dev))) + return; + +- if (!pskb_may_pull(skb, arp_hdr_len(dev))) { +- dev->stats.tx_dropped++; +- return; +- } + parp = arp_hdr(skb); + + if (parp->ar_pro != htons(ETH_P_IP) || diff --git a/queue-4.4/net-dsa-mv88e6xxx-enable-sa-learning-on-dsa-ports.patch b/queue-4.4/net-dsa-mv88e6xxx-enable-sa-learning-on-dsa-ports.patch new file mode 100644 index 00000000000..af426c64607 --- /dev/null +++ b/queue-4.4/net-dsa-mv88e6xxx-enable-sa-learning-on-dsa-ports.patch @@ -0,0 +1,38 @@ +From 996ecb8246676100af2a4dc1cfed747712a3c85f Mon Sep 17 00:00:00 2001 +From: Vivien Didelot +Date: Thu, 14 Apr 2016 14:42:08 -0400 +Subject: net: dsa: mv88e6xxx: enable SA learning on DSA ports + +From: Vivien Didelot + +commit 996ecb8246676100af2a4dc1cfed747712a3c85f upstream. + +In multi-chip systems, DSA Tag ports must learn SA addresses in order to +correctly switch frames between interconnected chips. + +This fixes cross-chip hardware bridging in a VLAN filtering aware +system, because a bridge group gets implemented as an hardware 802.1Q +VLAN and thus DSA and user ports share the same FDB. + +Fixes: 4c7ea3c0791e ("net: dsa: mv88e6xxx: disable SA learning for DSA and CPU ports") +Signed-off-by: Vivien Didelot +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/dsa/mv88e6xxx.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/dsa/mv88e6xxx.c ++++ b/drivers/net/dsa/mv88e6xxx.c +@@ -2064,8 +2064,8 @@ static int mv88e6xxx_setup_port(struct d + * the other bits clear. + */ + reg = 1 << port; +- /* Disable learning for DSA and CPU ports */ +- if (dsa_is_cpu_port(ds, port) || dsa_is_dsa_port(ds, port)) ++ /* Disable learning for CPU port */ ++ if (dsa_is_cpu_port(ds, port)) + reg = 0; + + ret = _mv88e6xxx_reg_write(ds, REG_PORT(port), PORT_ASSOC_VECTOR, reg); diff --git a/queue-4.4/net-dsa-mv88e6xxx-fix-port-vlan-maps.patch b/queue-4.4/net-dsa-mv88e6xxx-fix-port-vlan-maps.patch new file mode 100644 index 00000000000..f306eeb1591 --- /dev/null +++ b/queue-4.4/net-dsa-mv88e6xxx-fix-port-vlan-maps.patch @@ -0,0 +1,53 @@ +From be1faa92e83b1252d9200c59d8c98aab44463f1e Mon Sep 17 00:00:00 2001 +From: Vivien Didelot +Date: Thu, 28 Jan 2016 16:54:37 -0500 +Subject: net: dsa: mv88e6xxx: fix port VLAN maps + +From: Vivien Didelot + +commit be1faa92e83b1252d9200c59d8c98aab44463f1e upstream. + +Currently the port based VLAN maps should be configured to allow every +port to egress frames on all other ports, except themselves. + +The debugfs interface shows that they are misconfigured. For instance, a +7-port switch has the following content in the related register 0x06: + + GLOBAL GLOBAL2 SERDES 0 1 2 3 4 5 6 + ... + 6: 1fa4 1f0f 4 7f 7e 7d 7c 7b 7a 79 + ... + +This means that port 3 is allowed to talk to port 2-6, but cannot talk +to ports 0 and 1. With this fix, port 3 can correctly talk to all ports +except 3 itself: + + GLOBAL GLOBAL2 SERDES 0 1 2 3 4 5 6 + ... + 6: 1fa4 1f0f 4 7e 7d 7b 77 6f 5f 3f + ... + +Fixes: ede8098d0fef ("net: dsa: mv88e6xxx: bridges do not need an FID") +Reported-by: Kevin Smith +Signed-off-by: Vivien Didelot +Reviewed-by: Andrew Lunn +Tested-by: Kevin Smith +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/dsa/mv88e6xxx.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/dsa/mv88e6xxx.c ++++ b/drivers/net/dsa/mv88e6xxx.c +@@ -2150,7 +2150,8 @@ static int mv88e6xxx_setup_port(struct d + * database, and allow every port to egress frames on all other ports. + */ + reg = BIT(ps->num_ports) - 1; /* all ports */ +- ret = _mv88e6xxx_port_vlan_map_set(ds, port, reg & ~port); ++ reg &= ~BIT(port); /* except itself */ ++ ret = _mv88e6xxx_port_vlan_map_set(ds, port, reg); + if (ret) + goto abort; + diff --git a/queue-4.4/net-ehea-avoid-null-pointer-dereference.patch b/queue-4.4/net-ehea-avoid-null-pointer-dereference.patch new file mode 100644 index 00000000000..67a452d4092 --- /dev/null +++ b/queue-4.4/net-ehea-avoid-null-pointer-dereference.patch @@ -0,0 +1,44 @@ +From 1740c29a46b30a2f157afc473156f157e599d4c2 Mon Sep 17 00:00:00 2001 +From: "xypron.glpk@gmx.de" +Date: Tue, 17 May 2016 22:28:54 +0200 +Subject: net: ehea: avoid null pointer dereference + +From: xypron.glpk@gmx.de + +commit 1740c29a46b30a2f157afc473156f157e599d4c2 upstream. + +ehea_get_port may return NULL. Do not dereference NULL value. + +Fixes: 8c4877a4128e ("ehea: Use the standard logging functions") +Signed-off-by: Heinrich Schuchardt +Acked-by: Thadeu Lima de Souza Cascardo +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/ibm/ehea/ehea_main.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +--- a/drivers/net/ethernet/ibm/ehea/ehea_main.c ++++ b/drivers/net/ethernet/ibm/ehea/ehea_main.c +@@ -1169,16 +1169,15 @@ static void ehea_parse_eqe(struct ehea_a + ec = EHEA_BMASK_GET(NEQE_EVENT_CODE, eqe); + portnum = EHEA_BMASK_GET(NEQE_PORTNUM, eqe); + port = ehea_get_port(adapter, portnum); ++ if (!port) { ++ netdev_err(NULL, "unknown portnum %x\n", portnum); ++ return; ++ } + dev = port->netdev; + + switch (ec) { + case EHEA_EC_PORTSTATE_CHG: /* port state change */ + +- if (!port) { +- netdev_err(dev, "unknown portnum %x\n", portnum); +- break; +- } +- + if (EHEA_BMASK_GET(NEQE_PORT_UP, eqe)) { + if (!netif_carrier_ok(dev)) { + ret = ehea_sense_port_attr(port); diff --git a/queue-4.4/net-ep93xx_eth-do-not-crash-unloading-module.patch b/queue-4.4/net-ep93xx_eth-do-not-crash-unloading-module.patch new file mode 100644 index 00000000000..1d09bac3045 --- /dev/null +++ b/queue-4.4/net-ep93xx_eth-do-not-crash-unloading-module.patch @@ -0,0 +1,54 @@ +From c823abac17926767fb50175e098f087a6ac684c3 Mon Sep 17 00:00:00 2001 +From: Florian Fainelli +Date: Sun, 4 Dec 2016 19:22:05 -0800 +Subject: net: ep93xx_eth: Do not crash unloading module + +From: Florian Fainelli + +commit c823abac17926767fb50175e098f087a6ac684c3 upstream. + +When we unload the ep93xx_eth, whether we have opened the network +interface or not, we will either hit a kernel paging request error, or a +simple NULL pointer de-reference because: + +- if ep93xx_open has been called, we have created a valid DMA mapping + for ep->descs, when we call ep93xx_stop, we also call + ep93xx_free_buffers, ep->descs now has a stale value + +- if ep93xx_open has not been called, we have a NULL pointer for + ep->descs, so performing any operation against that address just won't + work + +Fix this by adding a NULL pointer check for ep->descs which means that +ep93xx_free_buffers() was able to successfully tear down the descriptors +and free the DMA cookie as well. + +Fixes: 1d22e05df818 ("[PATCH] Cirrus Logic ep93xx ethernet driver") +Signed-off-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/cirrus/ep93xx_eth.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/net/ethernet/cirrus/ep93xx_eth.c ++++ b/drivers/net/ethernet/cirrus/ep93xx_eth.c +@@ -468,6 +468,9 @@ static void ep93xx_free_buffers(struct e + struct device *dev = ep->dev->dev.parent; + int i; + ++ if (!ep->descs) ++ return; ++ + for (i = 0; i < RX_QUEUE_ENTRIES; i++) { + dma_addr_t d; + +@@ -490,6 +493,7 @@ static void ep93xx_free_buffers(struct e + + dma_free_coherent(dev, sizeof(struct ep93xx_descs), ep->descs, + ep->descs_dma_addr); ++ ep->descs = NULL; + } + + static int ep93xx_alloc_buffers(struct ep93xx_priv *ep) diff --git a/queue-4.4/net-ethernet-davinci_emac-fix-devioctl-while-in-fixed-link.patch b/queue-4.4/net-ethernet-davinci_emac-fix-devioctl-while-in-fixed-link.patch new file mode 100644 index 00000000000..8bdf781e1f5 --- /dev/null +++ b/queue-4.4/net-ethernet-davinci_emac-fix-devioctl-while-in-fixed-link.patch @@ -0,0 +1,38 @@ +From 62522ef3c399996f6c8120bfd14b94280bc9f490 Mon Sep 17 00:00:00 2001 +From: Neil Armstrong +Date: Mon, 25 Apr 2016 19:41:38 +0200 +Subject: net: ethernet: davinci_emac: Fix devioctl while in fixed link + +From: Neil Armstrong + +commit 62522ef3c399996f6c8120bfd14b94280bc9f490 upstream. + +When configured in fixed link, the DaVinci emac driver sets the +priv->phydev to NULL and further ioctl calls to the phy_mii_ioctl() +causes the kernel to crash. + +Cc: Brian Hutchinson +Fixes: 1bb6aa56bb38 ("net: davinci_emac: Add support for fixed-link PHY") +Signed-off-by: Neil Armstrong +Reviewed-by: Mugunthan V N +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/ti/davinci_emac.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/ti/davinci_emac.c ++++ b/drivers/net/ethernet/ti/davinci_emac.c +@@ -1512,7 +1512,10 @@ static int emac_devioctl(struct net_devi + + /* TODO: Add phy read and write and private statistics get feature */ + +- return phy_mii_ioctl(priv->phydev, ifrq, cmd); ++ if (priv->phydev) ++ return phy_mii_ioctl(priv->phydev, ifrq, cmd); ++ else ++ return -EOPNOTSUPP; + } + + static int match_first_device(struct device *dev, void *data) diff --git a/queue-4.4/net-ethernet-davinci_emac-fix-platform_data-overwrite.patch b/queue-4.4/net-ethernet-davinci_emac-fix-platform_data-overwrite.patch new file mode 100644 index 00000000000..1d5e1d924d9 --- /dev/null +++ b/queue-4.4/net-ethernet-davinci_emac-fix-platform_data-overwrite.patch @@ -0,0 +1,47 @@ +From 210990b05a1247886539078e857cd038881bb2d6 Mon Sep 17 00:00:00 2001 +From: Neil Armstrong +Date: Wed, 20 Apr 2016 10:56:45 +0200 +Subject: net: ethernet: davinci_emac: Fix platform_data overwrite + +From: Neil Armstrong + +commit 210990b05a1247886539078e857cd038881bb2d6 upstream. + +When the DaVinci emac driver is removed and re-probed, the actual +pdev->dev.platform_data is populated with an unwanted valid pointer saved by +the previous davinci_emac_of_get_pdata() call, causing a kernel crash when +calling priv->int_disable() in emac_int_disable(). + +Unable to handle kernel paging request at virtual address c8622a80 +... +[] (emac_int_disable) from [] (emac_dev_open+0x290/0x5f8) +[] (emac_dev_open) from [] (__dev_open+0xb8/0x120) +[] (__dev_open) from [] (__dev_change_flags+0x88/0x14c) +[] (__dev_change_flags) from [] (dev_change_flags+0x18/0x48) +[] (dev_change_flags) from [] (devinet_ioctl+0x6b4/0x7ac) +[] (devinet_ioctl) from [] (sock_ioctl+0x1d8/0x2c0) +[] (sock_ioctl) from [] (do_vfs_ioctl+0x41c/0x600) +[] (do_vfs_ioctl) from [] (SyS_ioctl+0x6c/0x7c) +[] (SyS_ioctl) from [] (ret_fast_syscall+0x0/0x1c) + +Fixes: 42f59967a091 ("net: ethernet: davinci_emac: add OF support") +Cc: Brian Hutchinson +Signed-off-by: Neil Armstrong +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/ti/davinci_emac.c | 2 -- + 1 file changed, 2 deletions(-) + +--- a/drivers/net/ethernet/ti/davinci_emac.c ++++ b/drivers/net/ethernet/ti/davinci_emac.c +@@ -1888,8 +1888,6 @@ davinci_emac_of_get_pdata(struct platfor + pdata->hw_ram_addr = auxdata->hw_ram_addr; + } + +- pdev->dev.platform_data = pdata; +- + return pdata; + } + diff --git a/queue-4.4/net-ethernet-mvneta-remove-iff_unicast_flt-which-is-not-implemented.patch b/queue-4.4/net-ethernet-mvneta-remove-iff_unicast_flt-which-is-not-implemented.patch new file mode 100644 index 00000000000..50c677887d5 --- /dev/null +++ b/queue-4.4/net-ethernet-mvneta-remove-iff_unicast_flt-which-is-not-implemented.patch @@ -0,0 +1,34 @@ +From 97db8afa2ab919fc400fe982f5054060868bdf07 Mon Sep 17 00:00:00 2001 +From: Andrew Lunn +Date: Thu, 24 Nov 2016 00:08:13 +0100 +Subject: net: ethernet: mvneta: Remove IFF_UNICAST_FLT which is not implemented + +From: Andrew Lunn + +commit 97db8afa2ab919fc400fe982f5054060868bdf07 upstream. + +The mvneta driver advertises it supports IFF_UNICAST_FLT. However, it +actually does not. The hardware probably does support it, but there is +no code to configure the filter. As a quick and simple fix, remove the +flag. This will cause the core to fall back to promiscuous mode. + +Signed-off-by: Andrew Lunn +Fixes: b50b72de2f2f ("net: mvneta: enable features before registering the driver") +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/marvell/mvneta.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/marvell/mvneta.c ++++ b/drivers/net/ethernet/marvell/mvneta.c +@@ -3406,7 +3406,7 @@ static int mvneta_probe(struct platform_ + dev->features = NETIF_F_SG | NETIF_F_IP_CSUM | NETIF_F_TSO; + dev->hw_features |= dev->features; + dev->vlan_features |= dev->features; +- dev->priv_flags |= IFF_UNICAST_FLT | IFF_LIVE_ADDR_CHANGE; ++ dev->priv_flags |= IFF_LIVE_ADDR_CHANGE; + dev->gso_max_segs = MVNETA_MAX_TSO_SEGS; + + err = register_netdev(dev); diff --git a/queue-4.4/net-ethernet-stmmac-dwmac-generic-fix-probe-error-path.patch b/queue-4.4/net-ethernet-stmmac-dwmac-generic-fix-probe-error-path.patch new file mode 100644 index 00000000000..7e270f7a9e7 --- /dev/null +++ b/queue-4.4/net-ethernet-stmmac-dwmac-generic-fix-probe-error-path.patch @@ -0,0 +1,42 @@ +From 939b20022765bc338b0f72cbf1eed60a907398d7 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 30 Nov 2016 15:29:52 +0100 +Subject: net: ethernet: stmmac: dwmac-generic: fix probe error path + +From: Johan Hovold + +commit 939b20022765bc338b0f72cbf1eed60a907398d7 upstream. + +Make sure to call any exit() callback to undo the effect of init() +before returning on late probe errors. + +Fixes: cf3f047b9af4 ("stmmac: move hw init in the probe (v2)") +Signed-off-by: Johan Hovold +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/stmicro/stmmac/dwmac-generic.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-generic.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-generic.c +@@ -53,7 +53,17 @@ static int dwmac_generic_probe(struct pl + return ret; + } + +- return stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res); ++ ret = stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res); ++ if (ret) ++ goto err_exit; ++ ++ return 0; ++ ++err_exit: ++ if (plat_dat->exit) ++ plat_dat->exit(pdev, plat_dat->bsp_priv); ++ ++ return ret; + } + + static const struct of_device_id dwmac_generic_match[] = { diff --git a/queue-4.4/net-ethernet-stmmac-dwmac-rk-fix-probe-error-path.patch b/queue-4.4/net-ethernet-stmmac-dwmac-rk-fix-probe-error-path.patch new file mode 100644 index 00000000000..76a12d2a6c3 --- /dev/null +++ b/queue-4.4/net-ethernet-stmmac-dwmac-rk-fix-probe-error-path.patch @@ -0,0 +1,41 @@ +From 2d222656db08b8eef3b53b56cf1ce4a90fe8cd78 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 30 Nov 2016 15:29:51 +0100 +Subject: net: ethernet: stmmac: dwmac-rk: fix probe error path + +From: Johan Hovold + +commit 2d222656db08b8eef3b53b56cf1ce4a90fe8cd78 upstream. + +Make sure to disable runtime PM, power down the PHY, and disable clocks +before returning on late probe errors. + +Fixes: 27ffefd2d109 ("stmmac: dwmac-rk: create a new probe function") +Signed-off-by: Johan Hovold +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c +@@ -600,7 +600,16 @@ static int rk_gmac_probe(struct platform + if (ret) + return ret; + +- return stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res); ++ ret = stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res); ++ if (ret) ++ goto err_gmac_exit; ++ ++ return 0; ++ ++err_gmac_exit: ++ rk_gmac_exit(pdev, plat_dat->bsp_priv); ++ ++ return ret; + } + + static const struct of_device_id rk_gmac_dwmac_match[] = { diff --git a/queue-4.4/net-ethernet-stmmac-dwmac-sti-fix-probe-error-path.patch b/queue-4.4/net-ethernet-stmmac-dwmac-sti-fix-probe-error-path.patch new file mode 100644 index 00000000000..9e0d996139b --- /dev/null +++ b/queue-4.4/net-ethernet-stmmac-dwmac-sti-fix-probe-error-path.patch @@ -0,0 +1,41 @@ +From 0a9e22715ee384cf2a714c28f24ce8881b9fd815 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 30 Nov 2016 15:29:50 +0100 +Subject: net: ethernet: stmmac: dwmac-sti: fix probe error path + +From: Johan Hovold + +commit 0a9e22715ee384cf2a714c28f24ce8881b9fd815 upstream. + +Make sure to disable clocks before returning on late probe errors. + +Fixes: 8387ee21f972 ("stmmac: dwmac-sti: turn setup callback into a +probe function") +Signed-off-by: Johan Hovold +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/stmicro/stmmac/dwmac-sti.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sti.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sti.c +@@ -365,7 +365,16 @@ static int sti_dwmac_probe(struct platfo + if (ret) + return ret; + +- return stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res); ++ ret = stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res); ++ if (ret) ++ goto err_dwmac_exit; ++ ++ return 0; ++ ++err_dwmac_exit: ++ sti_dwmac_exit(pdev, plat_dat->bsp_priv); ++ ++ return ret; + } + + static const struct sti_dwmac_of_data stih4xx_dwmac_data = { diff --git a/queue-4.4/net-ethernet-ti-cpsw-fix-device-and-of_node-leaks.patch b/queue-4.4/net-ethernet-ti-cpsw-fix-device-and-of_node-leaks.patch new file mode 100644 index 00000000000..14aea399afa --- /dev/null +++ b/queue-4.4/net-ethernet-ti-cpsw-fix-device-and-of_node-leaks.patch @@ -0,0 +1,42 @@ +From c7262aaace1b17a650598063e3b9ee1785fde377 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Thu, 3 Nov 2016 18:40:20 +0100 +Subject: net: ethernet: ti: cpsw: fix device and of_node leaks + +From: Johan Hovold + +commit c7262aaace1b17a650598063e3b9ee1785fde377 upstream. + +Make sure to drop the references taken by of_get_child_by_name() and +bus_find_device() before returning from cpsw_phy_sel(). + +Note that holding a reference to the cpsw-phy-sel device does not +prevent the devres-managed private data from going away. + +Fixes: 5892cd135e16 ("drivers: net: cpsw-phy-sel: Add new driver...") +Cc: Mugunthan V N +Cc: Grygorii Strashko +Cc: linux-omap@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/ti/cpsw-phy-sel.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/net/ethernet/ti/cpsw-phy-sel.c ++++ b/drivers/net/ethernet/ti/cpsw-phy-sel.c +@@ -154,9 +154,12 @@ void cpsw_phy_sel(struct device *dev, ph + } + + dev = bus_find_device(&platform_bus_type, NULL, node, match); ++ of_node_put(node); + priv = dev_get_drvdata(dev); + + priv->cpsw_phy_sel(priv, phy_mode, slave); ++ ++ put_device(dev); + } + EXPORT_SYMBOL_GPL(cpsw_phy_sel); + diff --git a/queue-4.4/net-ethernet-ti-cpsw-fix-secondary-emac-probe-error-path.patch b/queue-4.4/net-ethernet-ti-cpsw-fix-secondary-emac-probe-error-path.patch new file mode 100644 index 00000000000..bfa4e932d35 --- /dev/null +++ b/queue-4.4/net-ethernet-ti-cpsw-fix-secondary-emac-probe-error-path.patch @@ -0,0 +1,45 @@ +From a7fe9d466f6a33558a38c7ca9d58bcc83512d577 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Thu, 17 Nov 2016 17:40:02 +0100 +Subject: net: ethernet: ti: cpsw: fix secondary-emac probe error path + +From: Johan Hovold + +commit a7fe9d466f6a33558a38c7ca9d58bcc83512d577 upstream. + +Make sure to deregister the primary device in case the secondary emac +fails to probe. + +kernel BUG at /home/johan/work/omicron/src/linux/net/core/dev.c:7743! +... +[] (free_netdev) from [] (cpsw_probe+0x9cc/0xe50) +[] (cpsw_probe) from [] (platform_drv_probe+0x5c/0xc0) + +Fixes: d9ba8f9e6298 ("driver: net: ethernet: cpsw: dual emac interface +implementation") +Signed-off-by: Johan Hovold +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/ti/cpsw.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/ti/cpsw.c ++++ b/drivers/net/ethernet/ti/cpsw.c +@@ -2532,12 +2532,14 @@ static int cpsw_probe(struct platform_de + ret = cpsw_probe_dual_emac(pdev, priv); + if (ret) { + cpsw_err(priv, probe, "error probe slave 2 emac interface\n"); +- goto clean_ale_ret; ++ goto clean_unregister_netdev_ret; + } + } + + return 0; + ++clean_unregister_netdev_ret: ++ unregister_netdev(ndev); + clean_ale_ret: + cpsw_ale_destroy(priv->ale); + clean_dma_ret: diff --git a/queue-4.4/net-ethoc-fix-early-error-paths.patch b/queue-4.4/net-ethoc-fix-early-error-paths.patch new file mode 100644 index 00000000000..4b446921689 --- /dev/null +++ b/queue-4.4/net-ethoc-fix-early-error-paths.patch @@ -0,0 +1,73 @@ +From 386512d18b268c6182903239f9f3390f03ce4c7b Mon Sep 17 00:00:00 2001 +From: Florian Fainelli +Date: Tue, 12 Jul 2016 16:04:35 -0700 +Subject: net: ethoc: Fix early error paths + +From: Florian Fainelli + +commit 386512d18b268c6182903239f9f3390f03ce4c7b upstream. + +In case any operation fails before we can successfully go the point +where we would register a MDIO bus, we would be going to an error label +which involves unregistering then freeing this yet to be created MDIO +bus. Update all error paths to go to label free which is the only one +valid until either the clock is enabled, or the MDIO bus is allocated +and registered. This fixes kernel oops observed while trying to +dereference the MDIO bus structure which is not yet allocated. + +Fixes: a1702857724f ("net: Add support for the OpenCores 10/100 Mbps Ethernet MAC.") +Signed-off-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/ethoc.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/drivers/net/ethernet/ethoc.c ++++ b/drivers/net/ethernet/ethoc.c +@@ -1088,7 +1088,7 @@ static int ethoc_probe(struct platform_d + if (!priv->iobase) { + dev_err(&pdev->dev, "cannot remap I/O memory space\n"); + ret = -ENXIO; +- goto error; ++ goto free; + } + + if (netdev->mem_end) { +@@ -1097,7 +1097,7 @@ static int ethoc_probe(struct platform_d + if (!priv->membase) { + dev_err(&pdev->dev, "cannot remap memory space\n"); + ret = -ENXIO; +- goto error; ++ goto free; + } + } else { + /* Allocate buffer memory */ +@@ -1108,7 +1108,7 @@ static int ethoc_probe(struct platform_d + dev_err(&pdev->dev, "cannot allocate %dB buffer\n", + buffer_size); + ret = -ENOMEM; +- goto error; ++ goto free; + } + netdev->mem_end = netdev->mem_start + buffer_size; + priv->dma_alloc = buffer_size; +@@ -1122,7 +1122,7 @@ static int ethoc_probe(struct platform_d + 128, (netdev->mem_end - netdev->mem_start + 1) / ETHOC_BUFSIZ); + if (num_bd < 4) { + ret = -ENODEV; +- goto error; ++ goto free; + } + priv->num_bd = num_bd; + /* num_tx must be a power of two */ +@@ -1135,7 +1135,7 @@ static int ethoc_probe(struct platform_d + priv->vma = devm_kzalloc(&pdev->dev, num_bd*sizeof(void *), GFP_KERNEL); + if (!priv->vma) { + ret = -ENOMEM; +- goto error; ++ goto free; + } + + /* Allow the platform setup code to pass in a MAC address. */ diff --git a/queue-4.4/net-hns-fix-device-reference-leaks.patch b/queue-4.4/net-hns-fix-device-reference-leaks.patch new file mode 100644 index 00000000000..8639fbff611 --- /dev/null +++ b/queue-4.4/net-hns-fix-device-reference-leaks.patch @@ -0,0 +1,55 @@ +From 2271150bfb814b72ec57ae2fdf66e39da2eafafd Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Thu, 3 Nov 2016 18:40:22 +0100 +Subject: net: hns: fix device reference leaks + +From: Johan Hovold + +commit 2271150bfb814b72ec57ae2fdf66e39da2eafafd upstream. + +Make sure to drop the reference taken by class_find_device() in +hnae_get_handle() on errors and when later releasing the handle. + +Fixes: 6fe6611ff275 ("net: add Hisilicon Network Subsystem...") +Cc: Yisen Zhuang +Cc: Salil Mehta +Signed-off-by: Johan Hovold +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/hisilicon/hns/hnae.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/hisilicon/hns/hnae.c ++++ b/drivers/net/ethernet/hisilicon/hns/hnae.c +@@ -331,8 +331,10 @@ struct hnae_handle *hnae_get_handle(stru + return ERR_PTR(-ENODEV); + + handle = dev->ops->get_handle(dev, port_id); +- if (IS_ERR(handle)) ++ if (IS_ERR(handle)) { ++ put_device(&dev->cls_dev); + return handle; ++ } + + handle->dev = dev; + handle->owner_dev = owner_dev; +@@ -355,6 +357,8 @@ out_when_init_queue: + for (j = i - 1; j >= 0; j--) + hnae_fini_queue(handle->qs[j]); + ++ put_device(&dev->cls_dev); ++ + return ERR_PTR(-ENOMEM); + } + EXPORT_SYMBOL(hnae_get_handle); +@@ -376,6 +380,8 @@ void hnae_put_handle(struct hnae_handle + dev->ops->put_handle(h); + + module_put(dev->owner); ++ ++ put_device(&dev->cls_dev); + } + EXPORT_SYMBOL(hnae_put_handle); + diff --git a/queue-4.4/net-icmp6_send-should-use-dst-dev-to-determine-l3-domain.patch b/queue-4.4/net-icmp6_send-should-use-dst-dev-to-determine-l3-domain.patch new file mode 100644 index 00000000000..fb02b81104a --- /dev/null +++ b/queue-4.4/net-icmp6_send-should-use-dst-dev-to-determine-l3-domain.patch @@ -0,0 +1,33 @@ +From 5d41ce29e3b91ef305f88d23f72b3359de329cec Mon Sep 17 00:00:00 2001 +From: David Ahern +Date: Thu, 3 Nov 2016 16:17:26 -0700 +Subject: net: icmp6_send should use dst dev to determine L3 domain + +From: David Ahern + +commit 5d41ce29e3b91ef305f88d23f72b3359de329cec upstream. + +icmp6_send is called in response to some event. The skb may not have +the device set (skb->dev is NULL), but it is expected to have a dst set. +Update icmp6_send to use the dst on the skb to determine L3 domain. + +Fixes: ca254490c8dfd ("net: Add VRF support to IPv6 stack") +Signed-off-by: David Ahern +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/ipv6/icmp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/ipv6/icmp.c ++++ b/net/ipv6/icmp.c +@@ -446,7 +446,7 @@ static void icmp6_send(struct sk_buff *s + if (__ipv6_addr_needs_scope_id(addr_type)) + iif = skb->dev->ifindex; + else +- iif = l3mdev_master_ifindex(skb->dev); ++ iif = l3mdev_master_ifindex(skb_dst(skb)->dev); + + /* + * Must not send error if the source does not uniquely diff --git a/queue-4.4/net-icmp_route_lookup-should-use-rt-dev-to-determine-l3-domain.patch b/queue-4.4/net-icmp_route_lookup-should-use-rt-dev-to-determine-l3-domain.patch new file mode 100644 index 00000000000..a6f9d839b8f --- /dev/null +++ b/queue-4.4/net-icmp_route_lookup-should-use-rt-dev-to-determine-l3-domain.patch @@ -0,0 +1,43 @@ +From 9d1a6c4ea43e48c7880c85971c17939b56832d8a Mon Sep 17 00:00:00 2001 +From: David Ahern +Date: Mon, 7 Nov 2016 12:03:09 -0800 +Subject: net: icmp_route_lookup should use rt dev to determine L3 domain + +From: David Ahern + +commit 9d1a6c4ea43e48c7880c85971c17939b56832d8a upstream. + +icmp_send is called in response to some event. The skb may not have +the device set (skb->dev is NULL), but it is expected to have an rt. +Update icmp_route_lookup to use the rt on the skb to determine L3 +domain. + +Fixes: 613d09b30f8b ("net: Use VRF device index for lookups on TX") +Signed-off-by: David Ahern +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/ipv4/icmp.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/net/ipv4/icmp.c ++++ b/net/ipv4/icmp.c +@@ -478,7 +478,7 @@ static struct rtable *icmp_route_lookup( + fl4->flowi4_proto = IPPROTO_ICMP; + fl4->fl4_icmp_type = type; + fl4->fl4_icmp_code = code; +- fl4->flowi4_oif = l3mdev_master_ifindex(skb_in->dev); ++ fl4->flowi4_oif = l3mdev_master_ifindex(skb_dst(skb_in)->dev); + + security_skb_classify_flow(skb_in, flowi4_to_flowi(fl4)); + rt = __ip_route_output_key_hash(net, fl4, +@@ -503,7 +503,7 @@ static struct rtable *icmp_route_lookup( + if (err) + goto relookup_failed; + +- if (inet_addr_type_dev_table(net, skb_in->dev, ++ if (inet_addr_type_dev_table(net, skb_dst(skb_in)->dev, + fl4_dec.saddr) == RTN_LOCAL) { + rt2 = __ip_route_output_key(net, &fl4_dec); + if (IS_ERR(rt2)) diff --git a/queue-4.4/net-macb-add-missing-free_netdev-on-error-in-macb_probe.patch b/queue-4.4/net-macb-add-missing-free_netdev-on-error-in-macb_probe.patch new file mode 100644 index 00000000000..5e49b31058c --- /dev/null +++ b/queue-4.4/net-macb-add-missing-free_netdev-on-error-in-macb_probe.patch @@ -0,0 +1,32 @@ +From b22ae0b4d9669495158a7fa0fd027bd0fcd8896e Mon Sep 17 00:00:00 2001 +From: Wei Yongjun +Date: Fri, 12 Aug 2016 15:43:54 +0000 +Subject: net: macb: add missing free_netdev() on error in macb_probe() + +From: Wei Yongjun + +commit b22ae0b4d9669495158a7fa0fd027bd0fcd8896e upstream. + +Add the missing free_netdev() before return from function macb_probe() +in the platform_get_irq() error handling case. + +Fixes: c69618b3e4f2 ("net/macb: fix probe sequence to setup clocks earlier") +Signed-off-by: Wei Yongjun +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/cadence/macb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/cadence/macb.c ++++ b/drivers/net/ethernet/cadence/macb.c +@@ -2904,7 +2904,7 @@ static int macb_probe(struct platform_de + dev->irq = platform_get_irq(pdev, 0); + if (dev->irq < 0) { + err = dev->irq; +- goto err_disable_clocks; ++ goto err_out_free_netdev; + } + + mac = of_get_mac_address(np); diff --git a/queue-4.4/net-macb-replace-macb_writel-call-by-queue_writel-to-update-queue-isr.patch b/queue-4.4/net-macb-replace-macb_writel-call-by-queue_writel-to-update-queue-isr.patch new file mode 100644 index 00000000000..e628d1038ab --- /dev/null +++ b/queue-4.4/net-macb-replace-macb_writel-call-by-queue_writel-to-update-queue-isr.patch @@ -0,0 +1,46 @@ +From ba5049945421b8d2f3e2af786a15d13b82316503 Mon Sep 17 00:00:00 2001 +From: Cyrille Pitchen +Date: Thu, 24 Mar 2016 15:40:04 +0100 +Subject: net: macb: replace macb_writel() call by queue_writel() to update queue ISR + +From: Cyrille Pitchen + +commit ba5049945421b8d2f3e2af786a15d13b82316503 upstream. + +macb_interrupt() should not use macb_writel(bp, ISR, ) but only +queue_writel(queue, ISR, ). + +There is one IRQ and one set of {ISR, IER, IDR, IMR} [1] registers per +queue on gem hardware, though only queue0 is actually used for now to +receive frames: other queues can already be used to transmit frames. + +The queue_readl() and queue_writel() helper macros are designed to access +the relevant IRQ registers. + +[1] +ISR: Interrupt Status Register +IER: Interrupt Enable Register +IDR: Interrupt Disable Register +IMR: Interrupt Mask Register + +Signed-off-by: Cyrille Pitchen +Fixes: bfbb92c44670 ("net: macb: Handle the RXUBR interrupt on all devices") +Acked-by: Nicolas Ferre +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/cadence/macb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/cadence/macb.c ++++ b/drivers/net/ethernet/cadence/macb.c +@@ -1104,7 +1104,7 @@ static irqreturn_t macb_interrupt(int ir + macb_writel(bp, NCR, ctrl | MACB_BIT(RE)); + + if (bp->caps & MACB_CAPS_ISR_CLEAR_ON_WRITE) +- macb_writel(bp, ISR, MACB_BIT(RXUBR)); ++ queue_writel(queue, ISR, MACB_BIT(RXUBR)); + } + + if (status & MACB_BIT(ISR_ROVR)) { diff --git a/queue-4.4/net-mv643xx_eth-fix-packet-corruption-with-tso-and-tiny-unaligned-packets.patch b/queue-4.4/net-mv643xx_eth-fix-packet-corruption-with-tso-and-tiny-unaligned-packets.patch new file mode 100644 index 00000000000..6563b766fb0 --- /dev/null +++ b/queue-4.4/net-mv643xx_eth-fix-packet-corruption-with-tso-and-tiny-unaligned-packets.patch @@ -0,0 +1,43 @@ +From 3b89624ab54b9dc2d92fc08ce2670e5f19ad8ec8 Mon Sep 17 00:00:00 2001 +From: Nicolas Schichan +Date: Tue, 26 Jan 2016 16:12:35 +0100 +Subject: net: mv643xx_eth: fix packet corruption with TSO and tiny unaligned packets. + +From: Nicolas Schichan + +commit 3b89624ab54b9dc2d92fc08ce2670e5f19ad8ec8 upstream. + +The code in txq_put_data() would use txq->tx_curr_desc to index the +tso_hdrs/tso_hdrs_dma buffers, for less than 8 bytes unaligned +fragments, which is already moved to the next descriptor at the +beginning of the function. + +If that fragment was the last of the the skb, the next skb would use +that same space to place the ip headers, overwritting that small +fragment data. + +Fixes: 91986fd3d335 (net: mv643xx_eth: Ensure proper data alignment in TSO TX path) +Signed-off-by: Nicolas Schichan +Reviewed-by: Philipp Kirchhofer +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/marvell/mv643xx_eth.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/marvell/mv643xx_eth.c ++++ b/drivers/net/ethernet/marvell/mv643xx_eth.c +@@ -762,10 +762,10 @@ txq_put_data_tso(struct net_device *dev, + + if (length <= 8 && (uintptr_t)data & 0x7) { + /* Copy unaligned small data fragment to TSO header data area */ +- memcpy(txq->tso_hdrs + txq->tx_curr_desc * TSO_HEADER_SIZE, ++ memcpy(txq->tso_hdrs + tx_index * TSO_HEADER_SIZE, + data, length); + desc->buf_ptr = txq->tso_hdrs_dma +- + txq->tx_curr_desc * TSO_HEADER_SIZE; ++ + tx_index * TSO_HEADER_SIZE; + } else { + /* Alignment is okay, map buffer and hand off to hardware */ + txq->tx_desc_mapping[tx_index] = DESC_DMA_MAP_SINGLE; diff --git a/queue-4.4/net-mvneta-fix-trivial-cut-off-issue-in-mvneta_ethtool_update_stats.patch b/queue-4.4/net-mvneta-fix-trivial-cut-off-issue-in-mvneta_ethtool_update_stats.patch new file mode 100644 index 00000000000..dbf36708163 --- /dev/null +++ b/queue-4.4/net-mvneta-fix-trivial-cut-off-issue-in-mvneta_ethtool_update_stats.patch @@ -0,0 +1,54 @@ +From 2c832293e09be2f998ea916650927c8ccd5b4b3b Mon Sep 17 00:00:00 2001 +From: Jisheng Zhang +Date: Wed, 20 Jan 2016 16:36:25 +0800 +Subject: net: mvneta: fix trivial cut-off issue in mvneta_ethtool_update_stats + +From: Jisheng Zhang + +commit 2c832293e09be2f998ea916650927c8ccd5b4b3b upstream. + +When s->type is T_REG_64, the high 32bits are lost in val. This patch +fixes this trivial issue. + +Signed-off-by: Jisheng Zhang +Fixes: 9b0cdefa4cd5 ("net: mvneta: add ethtool statistics") +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/marvell/mvneta.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +--- a/drivers/net/ethernet/marvell/mvneta.c ++++ b/drivers/net/ethernet/marvell/mvneta.c +@@ -3058,26 +3058,25 @@ static void mvneta_ethtool_update_stats( + const struct mvneta_statistic *s; + void __iomem *base = pp->base; + u32 high, low, val; ++ u64 val64; + int i; + + for (i = 0, s = mvneta_statistics; + s < mvneta_statistics + ARRAY_SIZE(mvneta_statistics); + s++, i++) { +- val = 0; +- + switch (s->type) { + case T_REG_32: + val = readl_relaxed(base + s->offset); ++ pp->ethtool_stats[i] += val; + break; + case T_REG_64: + /* Docs say to read low 32-bit then high */ + low = readl_relaxed(base + s->offset); + high = readl_relaxed(base + s->offset + 4); +- val = (u64)high << 32 | low; ++ val64 = (u64)high << 32 | low; ++ pp->ethtool_stats[i] += val64; + break; + } +- +- pp->ethtool_stats[i] += val; + } + } + diff --git a/queue-4.4/net-skbuff-remove-errornous-length-validation-in-skb_vlan_pop.patch b/queue-4.4/net-skbuff-remove-errornous-length-validation-in-skb_vlan_pop.patch new file mode 100644 index 00000000000..cb7ee427972 --- /dev/null +++ b/queue-4.4/net-skbuff-remove-errornous-length-validation-in-skb_vlan_pop.patch @@ -0,0 +1,76 @@ +From 636c2628086e40c86dac7ddc84a1c4b4fcccc6e3 Mon Sep 17 00:00:00 2001 +From: Shmulik Ladkani +Date: Tue, 20 Sep 2016 12:48:36 +0300 +Subject: net: skbuff: Remove errornous length validation in skb_vlan_pop() + +From: Shmulik Ladkani + +commit 636c2628086e40c86dac7ddc84a1c4b4fcccc6e3 upstream. + +In 93515d53b1 + "net: move vlan pop/push functions into common code" +skb_vlan_pop was moved from its private location in openvswitch to +skbuff common code. + +In case skb has non hw-accel vlan tag, the original 'pop_vlan()' assured +that skb->len is sufficient (if skb->len < VLAN_ETH_HLEN then pop was +considered a no-op). + +This validation was moved as is into the new common 'skb_vlan_pop'. + +Alas, in its original location (openvswitch), there was a guarantee that +'data' points to the mac_header, therefore the 'skb->len < VLAN_ETH_HLEN' +condition made sense. +However there's no such guarantee in the generic 'skb_vlan_pop'. + +For short packets received in rx path going through 'skb_vlan_pop', +this causes 'skb_vlan_pop' to fail pop-ing a valid vlan hdr (in the non +hw-accel case) or to fail moving next tag into hw-accel tag. + +Remove the 'skb->len < VLAN_ETH_HLEN' condition entirely: +It is superfluous since inner '__skb_vlan_pop' already verifies there +are VLAN_ETH_HLEN writable bytes at the mac_header. + +Note this presents a slight change to skb_vlan_pop() users: +In case total length is smaller than VLAN_ETH_HLEN, skb_vlan_pop() now +returns an error, as opposed to previous "no-op" behavior. +Existing callers (e.g. tc act vlan, ovs) usually drop the packet if +'skb_vlan_pop' fails. + +Fixes: 93515d53b1 ("net: move vlan pop/push functions into common code") +Signed-off-by: Shmulik Ladkani +Cc: Pravin Shelar +Reviewed-by: Pravin B Shelar +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/core/skbuff.c | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +--- a/net/core/skbuff.c ++++ b/net/core/skbuff.c +@@ -4451,9 +4451,8 @@ int skb_vlan_pop(struct sk_buff *skb) + if (likely(skb_vlan_tag_present(skb))) { + skb->vlan_tci = 0; + } else { +- if (unlikely((skb->protocol != htons(ETH_P_8021Q) && +- skb->protocol != htons(ETH_P_8021AD)) || +- skb->len < VLAN_ETH_HLEN)) ++ if (unlikely(skb->protocol != htons(ETH_P_8021Q) && ++ skb->protocol != htons(ETH_P_8021AD))) + return 0; + + err = __skb_vlan_pop(skb, &vlan_tci); +@@ -4461,9 +4460,8 @@ int skb_vlan_pop(struct sk_buff *skb) + return err; + } + /* move next vlan tag to hw accel tag */ +- if (likely((skb->protocol != htons(ETH_P_8021Q) && +- skb->protocol != htons(ETH_P_8021AD)) || +- skb->len < VLAN_ETH_HLEN)) ++ if (likely(skb->protocol != htons(ETH_P_8021Q) && ++ skb->protocol != htons(ETH_P_8021AD))) + return 0; + + vlan_proto = skb->protocol; diff --git a/queue-4.4/net-vxlan-lwt-fix-vxlan-local-traffic.patch b/queue-4.4/net-vxlan-lwt-fix-vxlan-local-traffic.patch new file mode 100644 index 00000000000..e699d4c64f6 --- /dev/null +++ b/queue-4.4/net-vxlan-lwt-fix-vxlan-local-traffic.patch @@ -0,0 +1,46 @@ +From bbec7802c6948c8626b71a4fe31283cb4691c358 Mon Sep 17 00:00:00 2001 +From: pravin shelar +Date: Fri, 5 Aug 2016 17:45:37 -0700 +Subject: net: vxlan: lwt: Fix vxlan local traffic. + +From: pravin shelar + +commit bbec7802c6948c8626b71a4fe31283cb4691c358 upstream. + +vxlan driver has bypass for local vxlan traffic, but that +depends on information about all VNIs on local system in +vxlan driver. This is not available in case of LWT. +Therefore following patch disable encap bypass for LWT +vxlan traffic. + +Fixes: ee122c79d42 ("vxlan: Flow based tunneling"). +Reported-by: Jakub Libosvar +Signed-off-by: Pravin B Shelar +Acked-by: Jiri Benc +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/vxlan.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/vxlan.c ++++ b/drivers/net/vxlan.c +@@ -2054,7 +2054,7 @@ static void vxlan_xmit_one(struct sk_buf + } + + /* Bypass encapsulation if the destination is local */ +- if (rt->rt_flags & RTCF_LOCAL && ++ if (!info && rt->rt_flags & RTCF_LOCAL && + !(rt->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST))) { + struct vxlan_dev *dst_vxlan; + +@@ -2112,7 +2112,7 @@ static void vxlan_xmit_one(struct sk_buf + + /* Bypass encapsulation if the destination is local */ + rt6i_flags = ((struct rt6_info *)ndst)->rt6i_flags; +- if (rt6i_flags & RTF_LOCAL && ++ if (!info && rt6i_flags & RTF_LOCAL && + !(rt6i_flags & (RTCF_BROADCAST | RTCF_MULTICAST))) { + struct vxlan_dev *dst_vxlan; + diff --git a/queue-4.4/ovs-geneve-fix-rtnl-notifications-on-iface-deletion.patch b/queue-4.4/ovs-geneve-fix-rtnl-notifications-on-iface-deletion.patch new file mode 100644 index 00000000000..75debd1901b --- /dev/null +++ b/queue-4.4/ovs-geneve-fix-rtnl-notifications-on-iface-deletion.patch @@ -0,0 +1,40 @@ +From 41009481b690493c169ce85f591b9d32c6fd9422 Mon Sep 17 00:00:00 2001 +From: Nicolas Dichtel +Date: Mon, 13 Jun 2016 10:31:07 +0200 +Subject: ovs/geneve: fix rtnl notifications on iface deletion + +From: Nicolas Dichtel + +commit 41009481b690493c169ce85f591b9d32c6fd9422 upstream. + +The function geneve_dev_create_fb() (only used by ovs) never calls +rtnl_configure_link(). The consequence is that dev->rtnl_link_state is +never set to RTNL_LINK_INITIALIZED. +During the deletion phase, the function rollback_registered_many() sends +a RTM_DELLINK only if dev->rtnl_link_state is set to RTNL_LINK_INITIALIZED. + +Fixes: e305ac6cf5a1 ("geneve: Add support to collect tunnel metadata.") +CC: Pravin B Shelar +CC: Jesse Gross +CC: Thomas Graf +Signed-off-by: Nicolas Dichtel +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/geneve.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/net/geneve.c ++++ b/drivers/net/geneve.c +@@ -1363,6 +1363,10 @@ struct net_device *geneve_dev_create_fb( + if (err) + goto err; + ++ err = rtnl_configure_link(dev, NULL); ++ if (err < 0) ++ goto err; ++ + return dev; + + err: diff --git a/queue-4.4/ovs-gre-fix-rtnl-notifications-on-iface-deletion.patch b/queue-4.4/ovs-gre-fix-rtnl-notifications-on-iface-deletion.patch new file mode 100644 index 00000000000..42a7de78b08 --- /dev/null +++ b/queue-4.4/ovs-gre-fix-rtnl-notifications-on-iface-deletion.patch @@ -0,0 +1,39 @@ +From da6f1da819d4b9c081a477dec74dc468a0b44290 Mon Sep 17 00:00:00 2001 +From: Nicolas Dichtel +Date: Mon, 13 Jun 2016 10:31:06 +0200 +Subject: ovs/gre: fix rtnl notifications on iface deletion + +From: Nicolas Dichtel + +commit da6f1da819d4b9c081a477dec74dc468a0b44290 upstream. + +The function gretap_fb_dev_create() (only used by ovs) never calls +rtnl_configure_link(). The consequence is that dev->rtnl_link_state is +never set to RTNL_LINK_INITIALIZED. +During the deletion phase, the function rollback_registered_many() sends +a RTM_DELLINK only if dev->rtnl_link_state is set to RTNL_LINK_INITIALIZED. + +Fixes: b2acd1dc3949 ("openvswitch: Use regular GRE net_device instead of vport") +CC: Thomas Graf +CC: Pravin B Shelar +Signed-off-by: Nicolas Dichtel +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/ipv4/ip_gre.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/net/ipv4/ip_gre.c ++++ b/net/ipv4/ip_gre.c +@@ -1265,6 +1265,10 @@ struct net_device *gretap_fb_dev_create( + if (err) + goto out; + ++ err = rtnl_configure_link(dev, NULL); ++ if (err < 0) ++ goto out; ++ + return dev; + out: + ip_tunnel_dellink(dev, &list_kill); diff --git a/queue-4.4/ovs-vxlan-fix-rtnl-notifications-on-iface-deletion.patch b/queue-4.4/ovs-vxlan-fix-rtnl-notifications-on-iface-deletion.patch new file mode 100644 index 00000000000..9bbe962ad3e --- /dev/null +++ b/queue-4.4/ovs-vxlan-fix-rtnl-notifications-on-iface-deletion.patch @@ -0,0 +1,103 @@ +From cf5da330bbdd0c06b05c525a3d1d58ccd82c87a6 Mon Sep 17 00:00:00 2001 +From: Nicolas Dichtel +Date: Mon, 13 Jun 2016 10:31:05 +0200 +Subject: ovs/vxlan: fix rtnl notifications on iface deletion + +From: Nicolas Dichtel + +commit cf5da330bbdd0c06b05c525a3d1d58ccd82c87a6 upstream. + +The function vxlan_dev_create() (only used by ovs) never calls +rtnl_configure_link(). The consequence is that dev->rtnl_link_state is +never set to RTNL_LINK_INITIALIZED. +During the deletion phase, the function rollback_registered_many() sends +a RTM_DELLINK only if dev->rtnl_link_state is set to RTNL_LINK_INITIALIZED. + +Note that the function vxlan_dev_create() is moved after the rtnl stuff so +that vxlan_dellink() can be called in this function. + +Fixes: dcc38c033b32 ("openvswitch: Re-add CONFIG_OPENVSWITCH_VXLAN") +CC: Thomas Graf +CC: Pravin B Shelar +Signed-off-by: Nicolas Dichtel +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/vxlan.c | 58 ++++++++++++++++++++++++++++++---------------------- + 1 file changed, 34 insertions(+), 24 deletions(-) + +--- a/drivers/net/vxlan.c ++++ b/drivers/net/vxlan.c +@@ -2927,30 +2927,6 @@ static int vxlan_dev_configure(struct ne + return 0; + } + +-struct net_device *vxlan_dev_create(struct net *net, const char *name, +- u8 name_assign_type, struct vxlan_config *conf) +-{ +- struct nlattr *tb[IFLA_MAX+1]; +- struct net_device *dev; +- int err; +- +- memset(&tb, 0, sizeof(tb)); +- +- dev = rtnl_create_link(net, name, name_assign_type, +- &vxlan_link_ops, tb); +- if (IS_ERR(dev)) +- return dev; +- +- err = vxlan_dev_configure(net, dev, conf); +- if (err < 0) { +- free_netdev(dev); +- return ERR_PTR(err); +- } +- +- return dev; +-} +-EXPORT_SYMBOL_GPL(vxlan_dev_create); +- + static int vxlan_newlink(struct net *src_net, struct net_device *dev, + struct nlattr *tb[], struct nlattr *data[]) + { +@@ -3218,6 +3194,40 @@ static struct rtnl_link_ops vxlan_link_o + .get_link_net = vxlan_get_link_net, + }; + ++struct net_device *vxlan_dev_create(struct net *net, const char *name, ++ u8 name_assign_type, ++ struct vxlan_config *conf) ++{ ++ struct nlattr *tb[IFLA_MAX + 1]; ++ struct net_device *dev; ++ int err; ++ ++ memset(&tb, 0, sizeof(tb)); ++ ++ dev = rtnl_create_link(net, name, name_assign_type, ++ &vxlan_link_ops, tb); ++ if (IS_ERR(dev)) ++ return dev; ++ ++ err = vxlan_dev_configure(net, dev, conf); ++ if (err < 0) { ++ free_netdev(dev); ++ return ERR_PTR(err); ++ } ++ ++ err = rtnl_configure_link(dev, NULL); ++ if (err < 0) { ++ LIST_HEAD(list_kill); ++ ++ vxlan_dellink(dev, &list_kill); ++ unregister_netdevice_many(&list_kill); ++ return ERR_PTR(err); ++ } ++ ++ return dev; ++} ++EXPORT_SYMBOL_GPL(vxlan_dev_create); ++ + static void vxlan_handle_lowerdev_unregister(struct vxlan_net *vn, + struct net_device *dev) + { diff --git a/queue-4.4/pinctrl-tegra-correctly-check-the-supported-configuration.patch b/queue-4.4/pinctrl-tegra-correctly-check-the-supported-configuration.patch new file mode 100644 index 00000000000..b35ff52974d --- /dev/null +++ b/queue-4.4/pinctrl-tegra-correctly-check-the-supported-configuration.patch @@ -0,0 +1,56 @@ +From b22ef2a0979f2b91cfeeabb086e4d665183a93a1 Mon Sep 17 00:00:00 2001 +From: Laxman Dewangan +Date: Mon, 2 May 2016 22:53:24 +0530 +Subject: pinctrl: tegra: Correctly check the supported configuration + +From: Laxman Dewangan + +commit b22ef2a0979f2b91cfeeabb086e4d665183a93a1 upstream. + +The pincontrol registers of Tegra chips has multiple filed per +registers. There is two type of registers mux and drive. All +configurations belongs to one of these registers. + +If any configurations are supported then _bit is set to +bit position of these registers otherwise -1 to not support it. +The member is defined as + s32 _bit:6; + +So if config is not supported ifor given SoC then it is set to -1 +in soc pinmmux table. +In common driver code, to find out that given config is supported +or not, it is checked as: + +s8 bit = _bit; +if (bit > 31) { + /* Not supported config */ +} + +But in this case, bit is s8 and hence for non supporting it is -1. + +Correct the check as: +if (bit < 0) { + /* Not supported config */ +} + +Fixes: e4c02dced975cb ("pinctrl: tegra: use signed bitfields for optional fields") +Signed-off-by: Laxman Dewangan +Acked-by: Stephen Warren +Signed-off-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pinctrl/pinctrl-tegra.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/pinctrl/pinctrl-tegra.c ++++ b/drivers/pinctrl/pinctrl-tegra.c +@@ -418,7 +418,7 @@ static int tegra_pinconf_reg(struct tegr + return -ENOTSUPP; + } + +- if (*reg < 0 || *bit > 31) { ++ if (*reg < 0 || *bit < 0) { + if (report_err) { + const char *prop = "unknown"; + int i; diff --git a/queue-4.4/qdisc-fix-a-module-refcount-leak-in-qdisc_create_dflt.patch b/queue-4.4/qdisc-fix-a-module-refcount-leak-in-qdisc_create_dflt.patch new file mode 100644 index 00000000000..1ae525cac42 --- /dev/null +++ b/queue-4.4/qdisc-fix-a-module-refcount-leak-in-qdisc_create_dflt.patch @@ -0,0 +1,49 @@ +From 166ee5b87866de07a3e56c1b757f2b5cabba72a5 Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Wed, 24 Aug 2016 09:39:02 -0700 +Subject: qdisc: fix a module refcount leak in qdisc_create_dflt() + +From: Eric Dumazet + +commit 166ee5b87866de07a3e56c1b757f2b5cabba72a5 upstream. + +Should qdisc_alloc() fail, we must release the module refcount +we got right before. + +Fixes: 6da7c8fcbcbd ("qdisc: allow setting default queuing discipline") +Signed-off-by: Eric Dumazet +Acked-by: John Fastabend +Acked-by: John Fastabend +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/sched/sch_generic.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +--- a/net/sched/sch_generic.c ++++ b/net/sched/sch_generic.c +@@ -626,18 +626,19 @@ struct Qdisc *qdisc_create_dflt(struct n + struct Qdisc *sch; + + if (!try_module_get(ops->owner)) +- goto errout; ++ return NULL; + + sch = qdisc_alloc(dev_queue, ops); +- if (IS_ERR(sch)) +- goto errout; ++ if (IS_ERR(sch)) { ++ module_put(ops->owner); ++ return NULL; ++ } + sch->parent = parentid; + + if (!ops->init || ops->init(sch, NULL) == 0) + return sch; + + qdisc_destroy(sch); +-errout: + return NULL; + } + EXPORT_SYMBOL(qdisc_create_dflt); diff --git a/queue-4.4/ravb-add-missing-free_irq-call-to-ravb_close.patch b/queue-4.4/ravb-add-missing-free_irq-call-to-ravb_close.patch new file mode 100644 index 00000000000..60958b7a5de --- /dev/null +++ b/queue-4.4/ravb-add-missing-free_irq-call-to-ravb_close.patch @@ -0,0 +1,47 @@ +From 7fa816b92c52e2c304f2ff6401e0d51e1d229ca5 Mon Sep 17 00:00:00 2001 +From: Geert Uytterhoeven +Date: Sat, 7 May 2016 13:17:11 +0200 +Subject: ravb: Add missing free_irq() call to ravb_close() + +From: Geert Uytterhoeven + +commit 7fa816b92c52e2c304f2ff6401e0d51e1d229ca5 upstream. + +When reopening the network device on ra7795/salvator-x, e.g. after a +DHCP timeout: + + IP-Config: Reopening network devices... + genirq: Flags mismatch irq 139. 00000000 (eth0:ch24:emac) vs. 00000000 (eth0:ch24:emac) + ravb e6800000.ethernet eth0: cannot request IRQ eth0:ch24:emac + IP-Config: Failed to open eth0 + IP-Config: No network devices available + +The "mismatch" is due to requesting an IRQ that is already in use, +while IRQF_PROBE_SHARED wasn't set. + +However, the real cause is that ravb_close() doesn't release the R-Car +Gen3-specific secondary IRQ. + +Add the missing free_irq() call to fix this. + +Fixes: 22d4df8ff3a3cc72 ("ravb: Add support for r8a7795 SoC") +Signed-off-by: Geert Uytterhoeven +Acked-by: Sergei Shtylyov +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/renesas/ravb_main.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/net/ethernet/renesas/ravb_main.c ++++ b/drivers/net/ethernet/renesas/ravb_main.c +@@ -1528,6 +1528,8 @@ static int ravb_close(struct net_device + priv->phydev = NULL; + } + ++ if (priv->chip_id == RCAR_GEN3) ++ free_irq(priv->emac_irq, ndev); + free_irq(ndev->irq, ndev); + + napi_disable(&priv->napi[RAVB_NC]); diff --git a/queue-4.4/regulator-core-rely-on-regulator_dev_release-to-free-constraints.patch b/queue-4.4/regulator-core-rely-on-regulator_dev_release-to-free-constraints.patch new file mode 100644 index 00000000000..43d437f9edc --- /dev/null +++ b/queue-4.4/regulator-core-rely-on-regulator_dev_release-to-free-constraints.patch @@ -0,0 +1,136 @@ +From 6333ef46bbe514a8ece6c432aab6bcf8637b2d7c Mon Sep 17 00:00:00 2001 +From: Charles Keepax +Date: Tue, 26 Jan 2016 16:38:59 +0000 +Subject: regulator: core: Rely on regulator_dev_release to free constraints + +From: Charles Keepax + +commit 6333ef46bbe514a8ece6c432aab6bcf8637b2d7c upstream. + +As we now free the constraints in regulator_dev_release we will still +call free on the constraints pointer even if we went down an error +path in regulator_register, because it is only allocated after the +device_register. As such we no longer need to free rdev->constraints +on the error paths, so this patch removes said frees. + +Fixes: 29f5f4860a8e ("regulator: core: Move more deallocation into class unregister") +Signed-off-by: Charles Keepax +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/regulator/core.c | 29 ++++++++++++----------------- + 1 file changed, 12 insertions(+), 17 deletions(-) + +--- a/drivers/regulator/core.c ++++ b/drivers/regulator/core.c +@@ -1057,18 +1057,18 @@ static int set_machine_constraints(struc + + ret = machine_constraints_voltage(rdev, rdev->constraints); + if (ret != 0) +- goto out; ++ return ret; + + ret = machine_constraints_current(rdev, rdev->constraints); + if (ret != 0) +- goto out; ++ return ret; + + if (rdev->constraints->ilim_uA && ops->set_input_current_limit) { + ret = ops->set_input_current_limit(rdev, + rdev->constraints->ilim_uA); + if (ret < 0) { + rdev_err(rdev, "failed to set input limit\n"); +- goto out; ++ return ret; + } + } + +@@ -1077,21 +1077,20 @@ static int set_machine_constraints(struc + ret = suspend_prepare(rdev, rdev->constraints->initial_state); + if (ret < 0) { + rdev_err(rdev, "failed to set suspend state\n"); +- goto out; ++ return ret; + } + } + + if (rdev->constraints->initial_mode) { + if (!ops->set_mode) { + rdev_err(rdev, "no set_mode operation\n"); +- ret = -EINVAL; +- goto out; ++ return -EINVAL; + } + + ret = ops->set_mode(rdev, rdev->constraints->initial_mode); + if (ret < 0) { + rdev_err(rdev, "failed to set initial mode: %d\n", ret); +- goto out; ++ return ret; + } + } + +@@ -1102,7 +1101,7 @@ static int set_machine_constraints(struc + ret = _regulator_do_enable(rdev); + if (ret < 0 && ret != -EINVAL) { + rdev_err(rdev, "failed to enable\n"); +- goto out; ++ return ret; + } + } + +@@ -1111,7 +1110,7 @@ static int set_machine_constraints(struc + ret = ops->set_ramp_delay(rdev, rdev->constraints->ramp_delay); + if (ret < 0) { + rdev_err(rdev, "failed to set ramp_delay\n"); +- goto out; ++ return ret; + } + } + +@@ -1119,7 +1118,7 @@ static int set_machine_constraints(struc + ret = ops->set_pull_down(rdev); + if (ret < 0) { + rdev_err(rdev, "failed to set pull down\n"); +- goto out; ++ return ret; + } + } + +@@ -1127,7 +1126,7 @@ static int set_machine_constraints(struc + ret = ops->set_soft_start(rdev); + if (ret < 0) { + rdev_err(rdev, "failed to set soft start\n"); +- goto out; ++ return ret; + } + } + +@@ -1136,16 +1135,12 @@ static int set_machine_constraints(struc + ret = ops->set_over_current_protection(rdev); + if (ret < 0) { + rdev_err(rdev, "failed to set over current protection\n"); +- goto out; ++ return ret; + } + } + + print_constraints(rdev); + return 0; +-out: +- kfree(rdev->constraints); +- rdev->constraints = NULL; +- return ret; + } + + /** +@@ -3983,7 +3978,7 @@ unset_supplies: + + scrub: + regulator_ena_gpio_free(rdev); +- kfree(rdev->constraints); ++ + wash: + device_unregister(&rdev->dev); + /* device core frees rdev */ diff --git a/queue-4.4/regulator-try-to-resolve-regulators-supplies-on-registration.patch b/queue-4.4/regulator-try-to-resolve-regulators-supplies-on-registration.patch new file mode 100644 index 00000000000..c1d083f2645 --- /dev/null +++ b/queue-4.4/regulator-try-to-resolve-regulators-supplies-on-registration.patch @@ -0,0 +1,68 @@ +From 5e3ca2b349b1e2c80b060b51bbf2af37448fad85 Mon Sep 17 00:00:00 2001 +From: Javier Martinez Canillas +Date: Wed, 23 Mar 2016 20:59:34 -0300 +Subject: regulator: Try to resolve regulators supplies on registration + +From: Javier Martinez Canillas + +commit 5e3ca2b349b1e2c80b060b51bbf2af37448fad85 upstream. + +Commit 6261b06de565 ("regulator: Defer lookup of supply to regulator_get") +moved the regulator supplies lookup logic from the regulators registration +to the regulators get time. + +Unfortunately, that changed the behavior of the regulator core since now a +parent supply with a child regulator marked as always-on, won't be enabled +unless a client driver attempts to get the child regulator during boot. + +This patch tries to resolve the parent supply for the already registered +regulators each time that a new regulator is registered. So the regulators +that have child regulators marked as always on will be enabled regardless +if a driver gets the child regulator or not. + +That was the behavior before the mentioned commit, since parent supplies +were looked up at regulator registration time instead of during child get. + +Since regulator_resolve_supply() checks for rdev->supply, most of the times +it will be a no-op. Errors aren't checked to keep the possible out of order +dependencies which was the motivation for the mentioned commit. + +Also, the supply being available will be enforced on regulator get anyways +in case the resolve fails on regulators registration. + +Fixes: 6261b06de565 ("regulator: Defer lookup of supply to regulator_get") +Suggested-by: Mark Brown +Signed-off-by: Javier Martinez Canillas +Signed-off-by: Mark Brown +Cc: # 4.1+ +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/regulator/core.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/drivers/regulator/core.c ++++ b/drivers/regulator/core.c +@@ -3822,6 +3822,11 @@ static void rdev_init_debugfs(struct reg + &rdev->bypass_count); + } + ++static int regulator_register_resolve_supply(struct device *dev, void *data) ++{ ++ return regulator_resolve_supply(dev_to_rdev(dev)); ++} ++ + /** + * regulator_register - register regulator + * @regulator_desc: regulator to register +@@ -3968,6 +3973,10 @@ regulator_register(const struct regulato + } + + rdev_init_debugfs(rdev); ++ ++ /* try to resolve regulators supply since a new one was registered */ ++ class_for_each_device(®ulator_class, NULL, NULL, ++ regulator_register_resolve_supply); + out: + mutex_unlock(®ulator_list_mutex); + kfree(config); diff --git a/queue-4.4/rtnl-reset-calcit-fptr-in-rtnl_unregister.patch b/queue-4.4/rtnl-reset-calcit-fptr-in-rtnl_unregister.patch new file mode 100644 index 00000000000..bf6ea2ced6b --- /dev/null +++ b/queue-4.4/rtnl-reset-calcit-fptr-in-rtnl_unregister.patch @@ -0,0 +1,37 @@ +From f567e950bf51290755a2539ff2aaef4c26f735d3 Mon Sep 17 00:00:00 2001 +From: Mathias Krause +Date: Mon, 7 Nov 2016 23:22:19 +0100 +Subject: rtnl: reset calcit fptr in rtnl_unregister() + +From: Mathias Krause + +commit f567e950bf51290755a2539ff2aaef4c26f735d3 upstream. + +To avoid having dangling function pointers left behind, reset calcit in +rtnl_unregister(), too. + +This is no issue so far, as only the rtnl core registers a netlink +handler with a calcit hook which won't be unregistered, but may become +one if new code makes use of the calcit hook. + +Fixes: c7ac8679bec9 ("rtnetlink: Compute and store minimum ifinfo...") +Cc: Jeff Kirsher +Cc: Greg Rose +Signed-off-by: Mathias Krause +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/core/rtnetlink.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/net/core/rtnetlink.c ++++ b/net/core/rtnetlink.c +@@ -253,6 +253,7 @@ int rtnl_unregister(int protocol, int ms + + rtnl_msg_handlers[protocol][msgindex].doit = NULL; + rtnl_msg_handlers[protocol][msgindex].dumpit = NULL; ++ rtnl_msg_handlers[protocol][msgindex].calcit = NULL; + + return 0; + } diff --git a/queue-4.4/series b/queue-4.4/series index a0a7215a825..4999ea0e25b 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -259,3 +259,62 @@ dmaengine-edma-add-probe-callback-to-edma_tptc_driver.patch spi-rockchip-modify-dma-max-burst-to-1.patch openvswitch-update-checksum-in-push-pop-_mpls.patch cxgb4-cxgb4vf-fixes-regression-in-perf-when-tx-vlan-offload-is-disabled.patch +net-bcmgenet-fix-skb_len-in-bcmgenet_xmit_single.patch +net-bcmgenet-device-stats-are-unsigned-long.patch +ovs-gre-fix-rtnl-notifications-on-iface-deletion.patch +gre-do-not-assign-header_ops-in-collect-metadata-mode.patch +gre-build-header-correctly-for-collect-metadata-tunnels.patch +gre-reject-gue-and-fou-in-collect-metadata-mode.patch +sfc-fix-potential-stack-corruption-from-running-past-stat-bitmask.patch +sfc-clear-napi_hash-state-when-copying-channels.patch +net-bcmsysport-device-stats-are-unsigned-long.patch +cxgbi-fix-uninitialized-flowi6.patch +net-macb-add-missing-free_netdev-on-error-in-macb_probe.patch +macvtap-segmented-packet-is-consumed.patch +tipc-fix-the-error-handling-in-tipc_udp_enable.patch +net-icmp6_send-should-use-dst-dev-to-determine-l3-domain.patch +et131x-fix-logical-vs-bitwise-check-in-et131x_tx_timeout.patch +net-ethernet-stmmac-dwmac-sti-fix-probe-error-path.patch +rtnl-reset-calcit-fptr-in-rtnl_unregister.patch +net-ethernet-stmmac-dwmac-rk-fix-probe-error-path.patch +fq_codel-return-non-zero-qlen-in-class-dumps.patch +net-ethernet-stmmac-dwmac-generic-fix-probe-error-path.patch +ovs-geneve-fix-rtnl-notifications-on-iface-deletion.patch +bnxt-add-a-missing-rcu-synchronization.patch +qdisc-fix-a-module-refcount-leak-in-qdisc_create_dflt.patch +net-axienet-fix-return-value-check-in-axienet_probe.patch +bnxt_en-remove-locking-around-txr-dev_state.patch +net-ethernet-davinci_emac-fix-devioctl-while-in-fixed-link.patch +net-ethernet-mvneta-remove-iff_unicast_flt-which-is-not-implemented.patch +net-ethernet-ti-cpsw-fix-device-and-of_node-leaks.patch +net-ethernet-ti-cpsw-fix-secondary-emac-probe-error-path.patch +net-hns-fix-device-reference-leaks.patch +net-bridge-don-t-increment-tx_dropped-in-br_do_proxy_arp.patch +net-dsa-mv88e6xxx-enable-sa-learning-on-dsa-ports.patch +net-ehea-avoid-null-pointer-dereference.patch +l2tp-fix-use-after-free-during-module-unload.patch +hwrng-exynos-disable-runtime-pm-on-driver-unbind.patch +net-icmp_route_lookup-should-use-rt-dev-to-determine-l3-domain.patch +net-mvneta-fix-trivial-cut-off-issue-in-mvneta_ethtool_update_stats.patch +net-macb-replace-macb_writel-call-by-queue_writel-to-update-queue-isr.patch +ravb-add-missing-free_irq-call-to-ravb_close.patch +mvpp2-use-correct-size-for-memset.patch +net-vxlan-lwt-fix-vxlan-local-traffic.patch +net-ethoc-fix-early-error-paths.patch +ovs-vxlan-fix-rtnl-notifications-on-iface-deletion.patch +net-mv643xx_eth-fix-packet-corruption-with-tso-and-tiny-unaligned-packets.patch +regulator-core-rely-on-regulator_dev_release-to-free-constraints.patch +net-dsa-mv88e6xxx-fix-port-vlan-maps.patch +at803x-fix-reset-handling.patch +regulator-try-to-resolve-regulators-supplies-on-registration.patch +cxl-fix-dar-check-use-region_id-instead-of-opencoding.patch +net-ethernet-davinci_emac-fix-platform_data-overwrite.patch +ata-sata_dwc_460ex-remove-incorrect-locking.patch +pinctrl-tegra-correctly-check-the-supported-configuration.patch +brcmfmac-add-fallback-for-devices-that-do-not-report-per-chain-values.patch +brcmfmac-restore-stopping-netdev-queue-when-bus-clogs-up.patch +bridge-fix-problems-around-fdb-entries-pointing-to-the-bridge-device.patch +bna-add-missing-per-queue-ethtool-stat.patch +net-skbuff-remove-errornous-length-validation-in-skb_vlan_pop.patch +net-ep93xx_eth-do-not-crash-unloading-module.patch +macvlan-fix-potential-use-after-free-for-broadcasts.patch diff --git a/queue-4.4/sfc-clear-napi_hash-state-when-copying-channels.patch b/queue-4.4/sfc-clear-napi_hash-state-when-copying-channels.patch new file mode 100644 index 00000000000..8465d5bafd6 --- /dev/null +++ b/queue-4.4/sfc-clear-napi_hash-state-when-copying-channels.patch @@ -0,0 +1,45 @@ +From 46d054f8f540612f09987a53154aa39ae15f2e4c Mon Sep 17 00:00:00 2001 +From: Bert Kenward +Date: Fri, 11 Nov 2016 15:56:51 +0000 +Subject: sfc: clear napi_hash state when copying channels + +From: Bert Kenward + +commit 46d054f8f540612f09987a53154aa39ae15f2e4c upstream. + +efx_copy_channel() doesn't correctly clear the napi_hash related state. +This means that when napi_hash_add is called for that channel nothing is +done, and we are left with a copy of the napi_hash_node from the old +channel. When we later call napi_hash_del() on this channel we have a +stale napi_hash_node. + +Corruption is only seen when there are multiple entries in one of the +napi_hash lists. This is made more likely by having a very large number +of channels. Testing was carried out with 512 channels - 32 channels on +each of 16 ports. + +This failure typically appears as protection faults within napi_by_id() +or napi_hash_add(). efx_copy_channel() is only used when tx or rx ring +sizes are changed (ethtool -G). + +Fixes: 36763266bbe8 ("sfc: Add support for busy polling") +Signed-off-by: Bert Kenward +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/sfc/efx.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/net/ethernet/sfc/efx.c ++++ b/drivers/net/ethernet/sfc/efx.c +@@ -479,6 +479,9 @@ efx_copy_channel(const struct efx_channe + *channel = *old_channel; + + channel->napi_dev = NULL; ++ INIT_HLIST_NODE(&channel->napi_str.napi_hash_node); ++ channel->napi_str.napi_id = 0; ++ channel->napi_str.state = 0; + memset(&channel->eventq, 0, sizeof(channel->eventq)); + + for (j = 0; j < EFX_TXQ_TYPES; j++) { diff --git a/queue-4.4/sfc-fix-potential-stack-corruption-from-running-past-stat-bitmask.patch b/queue-4.4/sfc-fix-potential-stack-corruption-from-running-past-stat-bitmask.patch new file mode 100644 index 00000000000..34747e6480f --- /dev/null +++ b/queue-4.4/sfc-fix-potential-stack-corruption-from-running-past-stat-bitmask.patch @@ -0,0 +1,40 @@ +From e70c70c38d7a5ced76fc8b1c4a7ccee76e9c2911 Mon Sep 17 00:00:00 2001 +From: Andrew Rybchenko +Date: Fri, 26 Aug 2016 11:19:34 +0100 +Subject: sfc: fix potential stack corruption from running past stat bitmask + +From: Andrew Rybchenko + +commit e70c70c38d7a5ced76fc8b1c4a7ccee76e9c2911 upstream. + +On 32-bit systems, mask is only an array of 3 longs, not 4, so don't try +to write to mask[3]. +Also include build-time checks in case the size of the bitmask changes. + +Fixes: 3c36a2aded8c ("sfc: display vadaptor statistics for all interfaces") +Signed-off-by: Edward Cree +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/sfc/ef10.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/sfc/ef10.c ++++ b/drivers/net/ethernet/sfc/ef10.c +@@ -1304,13 +1304,14 @@ static void efx_ef10_get_stat_mask(struc + } + + #if BITS_PER_LONG == 64 ++ BUILD_BUG_ON(BITS_TO_LONGS(EF10_STAT_COUNT) != 2); + mask[0] = raw_mask[0]; + mask[1] = raw_mask[1]; + #else ++ BUILD_BUG_ON(BITS_TO_LONGS(EF10_STAT_COUNT) != 3); + mask[0] = raw_mask[0] & 0xffffffff; + mask[1] = raw_mask[0] >> 32; + mask[2] = raw_mask[1] & 0xffffffff; +- mask[3] = raw_mask[1] >> 32; + #endif + } + diff --git a/queue-4.4/tipc-fix-the-error-handling-in-tipc_udp_enable.patch b/queue-4.4/tipc-fix-the-error-handling-in-tipc_udp_enable.patch new file mode 100644 index 00000000000..f2d9709b265 --- /dev/null +++ b/queue-4.4/tipc-fix-the-error-handling-in-tipc_udp_enable.patch @@ -0,0 +1,38 @@ +From a5de125dd46c851fc962806135953c1bd0a0f0df Mon Sep 17 00:00:00 2001 +From: Wei Yongjun +Date: Wed, 24 Aug 2016 13:32:19 +0000 +Subject: tipc: fix the error handling in tipc_udp_enable() + +From: Wei Yongjun + +commit a5de125dd46c851fc962806135953c1bd0a0f0df upstream. + +Fix to return a negative error code in enable_mcast() error handling +case, and release udp socket when necessary. + +Fixes: d0f91938bede ("tipc: add ip/udp media type") +Signed-off-by: Wei Yongjun +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/tipc/udp_media.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/net/tipc/udp_media.c ++++ b/net/tipc/udp_media.c +@@ -405,10 +405,13 @@ static int tipc_udp_enable(struct net *n + tuncfg.encap_destroy = NULL; + setup_udp_tunnel_sock(net, ub->ubsock, &tuncfg); + +- if (enable_mcast(ub, remote)) ++ err = enable_mcast(ub, remote); ++ if (err) + goto err; + return 0; + err: ++ if (ub->ubsock) ++ udp_tunnel_sock_release(ub->ubsock); + kfree(ub); + return err; + }