From: Sasha Levin Date: Thu, 1 Apr 2021 17:31:26 +0000 (-0400) Subject: Fixes for 5.4 X-Git-Tag: v4.4.265~65 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=0b099dfc0589f23c1216d818b18515e2184e2d03;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.4 Signed-off-by: Sasha Levin --- diff --git a/queue-5.4/appletalk-fix-skb-allocation-size-in-loopback-case.patch b/queue-5.4/appletalk-fix-skb-allocation-size-in-loopback-case.patch new file mode 100644 index 00000000000..8463cdeb6a2 --- /dev/null +++ b/queue-5.4/appletalk-fix-skb-allocation-size-in-loopback-case.patch @@ -0,0 +1,99 @@ +From 184ff7af4a5a964753cfe521f0b65d5d67c4b671 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Feb 2021 21:27:54 -0800 +Subject: appletalk: Fix skb allocation size in loopback case + +From: Doug Brown + +[ Upstream commit 39935dccb21c60f9bbf1bb72d22ab6fd14ae7705 ] + +If a DDP broadcast packet is sent out to a non-gateway target, it is +also looped back. There is a potential for the loopback device to have a +longer hardware header length than the original target route's device, +which can result in the skb not being created with enough room for the +loopback device's hardware header. This patch fixes the issue by +determining that a loopback will be necessary prior to allocating the +skb, and if so, ensuring the skb has enough room. + +This was discovered while testing a new driver that creates a LocalTalk +network interface (LTALK_HLEN = 1). It caused an skb_under_panic. + +Signed-off-by: Doug Brown +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/appletalk/ddp.c | 33 +++++++++++++++++++++------------ + 1 file changed, 21 insertions(+), 12 deletions(-) + +diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c +index b41375d4d295..4610c352849b 100644 +--- a/net/appletalk/ddp.c ++++ b/net/appletalk/ddp.c +@@ -1568,8 +1568,8 @@ static int atalk_sendmsg(struct socket *sock, struct msghdr *msg, size_t len) + struct sk_buff *skb; + struct net_device *dev; + struct ddpehdr *ddp; +- int size; +- struct atalk_route *rt; ++ int size, hard_header_len; ++ struct atalk_route *rt, *rt_lo = NULL; + int err; + + if (flags & ~(MSG_DONTWAIT|MSG_CMSG_COMPAT)) +@@ -1632,7 +1632,22 @@ static int atalk_sendmsg(struct socket *sock, struct msghdr *msg, size_t len) + SOCK_DEBUG(sk, "SK %p: Size needed %d, device %s\n", + sk, size, dev->name); + +- size += dev->hard_header_len; ++ hard_header_len = dev->hard_header_len; ++ /* Leave room for loopback hardware header if necessary */ ++ if (usat->sat_addr.s_node == ATADDR_BCAST && ++ (dev->flags & IFF_LOOPBACK || !(rt->flags & RTF_GATEWAY))) { ++ struct atalk_addr at_lo; ++ ++ at_lo.s_node = 0; ++ at_lo.s_net = 0; ++ ++ rt_lo = atrtr_find(&at_lo); ++ ++ if (rt_lo && rt_lo->dev->hard_header_len > hard_header_len) ++ hard_header_len = rt_lo->dev->hard_header_len; ++ } ++ ++ size += hard_header_len; + release_sock(sk); + skb = sock_alloc_send_skb(sk, size, (flags & MSG_DONTWAIT), &err); + lock_sock(sk); +@@ -1640,7 +1655,7 @@ static int atalk_sendmsg(struct socket *sock, struct msghdr *msg, size_t len) + goto out; + + skb_reserve(skb, ddp_dl->header_length); +- skb_reserve(skb, dev->hard_header_len); ++ skb_reserve(skb, hard_header_len); + skb->dev = dev; + + SOCK_DEBUG(sk, "SK %p: Begin build.\n", sk); +@@ -1691,18 +1706,12 @@ static int atalk_sendmsg(struct socket *sock, struct msghdr *msg, size_t len) + /* loop back */ + skb_orphan(skb); + if (ddp->deh_dnode == ATADDR_BCAST) { +- struct atalk_addr at_lo; +- +- at_lo.s_node = 0; +- at_lo.s_net = 0; +- +- rt = atrtr_find(&at_lo); +- if (!rt) { ++ if (!rt_lo) { + kfree_skb(skb); + err = -ENETUNREACH; + goto out; + } +- dev = rt->dev; ++ dev = rt_lo->dev; + skb->dev = dev; + } + ddp_dl->request(ddp_dl, skb, dev->dev_addr); +-- +2.30.1 + diff --git a/queue-5.4/ath10k-hold-rcu-lock-when-calling-ieee80211_find_sta.patch b/queue-5.4/ath10k-hold-rcu-lock-when-calling-ieee80211_find_sta.patch new file mode 100644 index 00000000000..0a50a690f9c --- /dev/null +++ b/queue-5.4/ath10k-hold-rcu-lock-when-calling-ieee80211_find_sta.patch @@ -0,0 +1,61 @@ +From 46b0159e643181a54a1de90afe1fcdc4c5a13179 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Feb 2021 14:21:07 -0700 +Subject: ath10k: hold RCU lock when calling ieee80211_find_sta_by_ifaddr() + +From: Shuah Khan + +[ Upstream commit 09078368d516918666a0122f2533dc73676d3d7e ] + +ieee80211_find_sta_by_ifaddr() must be called under the RCU lock and +the resulting pointer is only valid under RCU lock as well. + +Fix ath10k_wmi_tlv_op_pull_peer_stats_info() to hold RCU lock before it +calls ieee80211_find_sta_by_ifaddr() and release it when the resulting +pointer is no longer needed. + +This problem was found while reviewing code to debug RCU warn from +ath10k_wmi_tlv_parse_peer_stats_info(). + +Link: https://lore.kernel.org/linux-wireless/7230c9e5-2632-b77e-c4f9-10eca557a5bb@linuxfoundation.org/ +Signed-off-by: Shuah Khan +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20210210212107.40373-1-skhan@linuxfoundation.org +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath10k/wmi-tlv.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath10k/wmi-tlv.c b/drivers/net/wireless/ath/ath10k/wmi-tlv.c +index 3ec71f52e8fe..d38276ac375e 100644 +--- a/drivers/net/wireless/ath/ath10k/wmi-tlv.c ++++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.c +@@ -445,13 +445,13 @@ static void ath10k_wmi_event_tdls_peer(struct ath10k *ar, struct sk_buff *skb) + case WMI_TDLS_TEARDOWN_REASON_TX: + case WMI_TDLS_TEARDOWN_REASON_RSSI: + case WMI_TDLS_TEARDOWN_REASON_PTR_TIMEOUT: ++ rcu_read_lock(); + station = ieee80211_find_sta_by_ifaddr(ar->hw, + ev->peer_macaddr.addr, + NULL); + if (!station) { + ath10k_warn(ar, "did not find station from tdls peer event"); +- kfree(tb); +- return; ++ goto exit; + } + arvif = ath10k_get_arvif(ar, __le32_to_cpu(ev->vdev_id)); + ieee80211_tdls_oper_request( +@@ -462,6 +462,9 @@ static void ath10k_wmi_event_tdls_peer(struct ath10k *ar, struct sk_buff *skb) + ); + break; + } ++ ++exit: ++ rcu_read_unlock(); + kfree(tb); + } + +-- +2.30.1 + diff --git a/queue-5.4/brcmfmac-clear-eap-association-status-bits-on-linkdo.patch b/queue-5.4/brcmfmac-clear-eap-association-status-bits-on-linkdo.patch new file mode 100644 index 00000000000..73ddb664143 --- /dev/null +++ b/queue-5.4/brcmfmac-clear-eap-association-status-bits-on-linkdo.patch @@ -0,0 +1,63 @@ +From d0d1ae40cd03e77bf79ad0d4ba129e0979401262 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Dec 2020 11:51:59 +0100 +Subject: brcmfmac: clear EAP/association status bits on linkdown events + +From: Luca Pesce + +[ Upstream commit e862a3e4088070de352fdafe9bd9e3ae0a95a33c ] + +This ensure that previous association attempts do not leave stale statuses +on subsequent attempts. + +This fixes the WARN_ON(!cr->bss)) from __cfg80211_connect_result() when +connecting to an AP after a previous connection failure (e.g. where EAP fails +due to incorrect psk but association succeeded). In some scenarios, indeed, +brcmf_is_linkup() was reporting a link up event too early due to stale +BRCMF_VIF_STATUS_ASSOC_SUCCESS bit, thus reporting to cfg80211 a connection +result with a zeroed bssid (vif->profile.bssid is still empty), causing the +WARN_ON due to the call to cfg80211_get_bss() with the empty bssid. + +Signed-off-by: Luca Pesce +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/1608807119-21785-1-git-send-email-luca.pesce@vimar.com +Signed-off-by: Sasha Levin +--- + .../net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +index 4ca50353538e..cd813c69a178 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +@@ -5382,7 +5382,8 @@ static bool brcmf_is_linkup(struct brcmf_cfg80211_vif *vif, + return false; + } + +-static bool brcmf_is_linkdown(const struct brcmf_event_msg *e) ++static bool brcmf_is_linkdown(struct brcmf_cfg80211_vif *vif, ++ const struct brcmf_event_msg *e) + { + u32 event = e->event_code; + u16 flags = e->flags; +@@ -5391,6 +5392,8 @@ static bool brcmf_is_linkdown(const struct brcmf_event_msg *e) + (event == BRCMF_E_DISASSOC_IND) || + ((event == BRCMF_E_LINK) && (!(flags & BRCMF_EVENT_MSG_LINK)))) { + brcmf_dbg(CONN, "Processing link down\n"); ++ clear_bit(BRCMF_VIF_STATUS_EAP_SUCCESS, &vif->sme_state); ++ clear_bit(BRCMF_VIF_STATUS_ASSOC_SUCCESS, &vif->sme_state); + return true; + } + return false; +@@ -5683,7 +5686,7 @@ brcmf_notify_connect_status(struct brcmf_if *ifp, + } else + brcmf_bss_connect_done(cfg, ndev, e, true); + brcmf_net_setcarrier(ifp, true); +- } else if (brcmf_is_linkdown(e)) { ++ } else if (brcmf_is_linkdown(ifp->vif, e)) { + brcmf_dbg(CONN, "Linkdown\n"); + if (!brcmf_is_ibssmode(ifp->vif)) { + brcmf_bss_connect_done(cfg, ndev, e, false); +-- +2.30.1 + diff --git a/queue-5.4/can-dev-move-driver-related-infrastructure-into-sepa.patch b/queue-5.4/can-dev-move-driver-related-infrastructure-into-sepa.patch new file mode 100644 index 00000000000..a5c5b1c04e8 --- /dev/null +++ b/queue-5.4/can-dev-move-driver-related-infrastructure-into-sepa.patch @@ -0,0 +1,68 @@ +From fffedd69a4f242f7d5f898b4387318dec749a8b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Jan 2021 15:19:17 +0100 +Subject: can: dev: move driver related infrastructure into separate subdir + +From: Marc Kleine-Budde + +[ Upstream commit 3e77f70e734584e0ad1038e459ed3fd2400f873a ] + +This patch moves the CAN driver related infrastructure into a separate subdir. +It will be split into more files in the coming patches. + +Reviewed-by: Vincent Mailhol +Link: https://lore.kernel.org/r/20210111141930.693847-3-mkl@pengutronix.de +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/Makefile | 7 +------ + drivers/net/can/dev/Makefile | 7 +++++++ + drivers/net/can/{ => dev}/dev.c | 0 + drivers/net/can/{ => dev}/rx-offload.c | 0 + 4 files changed, 8 insertions(+), 6 deletions(-) + create mode 100644 drivers/net/can/dev/Makefile + rename drivers/net/can/{ => dev}/dev.c (100%) + rename drivers/net/can/{ => dev}/rx-offload.c (100%) + +diff --git a/drivers/net/can/Makefile b/drivers/net/can/Makefile +index 22164300122d..a2b4463d8480 100644 +--- a/drivers/net/can/Makefile ++++ b/drivers/net/can/Makefile +@@ -7,12 +7,7 @@ obj-$(CONFIG_CAN_VCAN) += vcan.o + obj-$(CONFIG_CAN_VXCAN) += vxcan.o + obj-$(CONFIG_CAN_SLCAN) += slcan.o + +-obj-$(CONFIG_CAN_DEV) += can-dev.o +-can-dev-y += dev.o +-can-dev-y += rx-offload.o +- +-can-dev-$(CONFIG_CAN_LEDS) += led.o +- ++obj-y += dev/ + obj-y += rcar/ + obj-y += spi/ + obj-y += usb/ +diff --git a/drivers/net/can/dev/Makefile b/drivers/net/can/dev/Makefile +new file mode 100644 +index 000000000000..cba92e6bcf6f +--- /dev/null ++++ b/drivers/net/can/dev/Makefile +@@ -0,0 +1,7 @@ ++# SPDX-License-Identifier: GPL-2.0 ++ ++obj-$(CONFIG_CAN_DEV) += can-dev.o ++can-dev-y += dev.o ++can-dev-y += rx-offload.o ++ ++can-dev-$(CONFIG_CAN_LEDS) += led.o +diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev/dev.c +similarity index 100% +rename from drivers/net/can/dev.c +rename to drivers/net/can/dev/dev.c +diff --git a/drivers/net/can/rx-offload.c b/drivers/net/can/dev/rx-offload.c +similarity index 100% +rename from drivers/net/can/rx-offload.c +rename to drivers/net/can/dev/rx-offload.c +-- +2.30.1 + diff --git a/queue-5.4/can-tcan4x5x-fix-max-register-value.patch b/queue-5.4/can-tcan4x5x-fix-max-register-value.patch new file mode 100644 index 00000000000..f78495f1845 --- /dev/null +++ b/queue-5.4/can-tcan4x5x-fix-max-register-value.patch @@ -0,0 +1,34 @@ +From bf3fe4b26262bc61174142855b65acf55c2d1ed8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Mar 2021 19:13:21 -0400 +Subject: can: tcan4x5x: fix max register value + +[ Upstream commit 6e1caaf8ed22eb700cc47ec353816eee33186c1c ] + +This patch fixes the max register value for the regmap. + +Reviewed-by: Dan Murphy +Tested-by: Sean Nyekjaer +Link: https://lore.kernel.org/r/20201215231746.1132907-12-mkl@pengutronix.de +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/m_can/tcan4x5x.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/can/m_can/tcan4x5x.c b/drivers/net/can/m_can/tcan4x5x.c +index 32cb479fe6ac..0d66582bd356 100644 +--- a/drivers/net/can/m_can/tcan4x5x.c ++++ b/drivers/net/can/m_can/tcan4x5x.c +@@ -88,7 +88,7 @@ + + #define TCAN4X5X_MRAM_START 0x8000 + #define TCAN4X5X_MCAN_OFFSET 0x1000 +-#define TCAN4X5X_MAX_REGISTER 0x8fff ++#define TCAN4X5X_MAX_REGISTER 0x8ffc + + #define TCAN4X5X_CLEAR_ALL_INT 0xffffffff + #define TCAN4X5X_SET_ALL_INT 0xffffffff +-- +2.30.1 + diff --git a/queue-5.4/flow_dissector-fix-ttl-and-tos-dissection-on-ipv4-fr.patch b/queue-5.4/flow_dissector-fix-ttl-and-tos-dissection-on-ipv4-fr.patch new file mode 100644 index 00000000000..43be29e466a --- /dev/null +++ b/queue-5.4/flow_dissector-fix-ttl-and-tos-dissection-on-ipv4-fr.patch @@ -0,0 +1,114 @@ +From 2344593fa47147cf69086da9b0441fa87f2b18a1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Feb 2021 16:12:25 +0100 +Subject: flow_dissector: fix TTL and TOS dissection on IPv4 fragments + +From: Davide Caratti + +[ Upstream commit d2126838050ccd1dadf310ffb78b2204f3b032b9 ] + +the following command: + + # tc filter add dev $h2 ingress protocol ip pref 1 handle 101 flower \ + $tcflags dst_ip 192.0.2.2 ip_ttl 63 action drop + +doesn't drop all IPv4 packets that match the configured TTL / destination +address. In particular, if "fragment offset" or "more fragments" have non +zero value in the IPv4 header, setting of FLOW_DISSECTOR_KEY_IP is simply +ignored. Fix this dissecting IPv4 TTL and TOS before fragment info; while +at it, add a selftest for tc flower's match on 'ip_ttl' that verifies the +correct behavior. + +Fixes: 518d8a2e9bad ("net/flow_dissector: add support for dissection of misc ip header fields") +Reported-by: Shuang Li +Signed-off-by: Davide Caratti +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/core/flow_dissector.c | 6 +-- + .../selftests/net/forwarding/tc_flower.sh | 38 ++++++++++++++++++- + 2 files changed, 40 insertions(+), 4 deletions(-) + +diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c +index e3bdd859c895..da86c0e1b677 100644 +--- a/net/core/flow_dissector.c ++++ b/net/core/flow_dissector.c +@@ -1028,6 +1028,9 @@ proto_again: + key_control->addr_type = FLOW_DISSECTOR_KEY_IPV4_ADDRS; + } + ++ __skb_flow_dissect_ipv4(skb, flow_dissector, ++ target_container, data, iph); ++ + if (ip_is_fragment(iph)) { + key_control->flags |= FLOW_DIS_IS_FRAGMENT; + +@@ -1044,9 +1047,6 @@ proto_again: + } + } + +- __skb_flow_dissect_ipv4(skb, flow_dissector, +- target_container, data, iph); +- + break; + } + case htons(ETH_P_IPV6): { +diff --git a/tools/testing/selftests/net/forwarding/tc_flower.sh b/tools/testing/selftests/net/forwarding/tc_flower.sh +index 058c746ee300..b11d8e6b5bc1 100755 +--- a/tools/testing/selftests/net/forwarding/tc_flower.sh ++++ b/tools/testing/selftests/net/forwarding/tc_flower.sh +@@ -3,7 +3,7 @@ + + ALL_TESTS="match_dst_mac_test match_src_mac_test match_dst_ip_test \ + match_src_ip_test match_ip_flags_test match_pcp_test match_vlan_test \ +- match_ip_tos_test match_indev_test" ++ match_ip_tos_test match_indev_test match_ip_ttl_test" + NUM_NETIFS=2 + source tc_common.sh + source lib.sh +@@ -310,6 +310,42 @@ match_ip_tos_test() + log_test "ip_tos match ($tcflags)" + } + ++match_ip_ttl_test() ++{ ++ RET=0 ++ ++ tc filter add dev $h2 ingress protocol ip pref 1 handle 101 flower \ ++ $tcflags dst_ip 192.0.2.2 ip_ttl 63 action drop ++ tc filter add dev $h2 ingress protocol ip pref 2 handle 102 flower \ ++ $tcflags dst_ip 192.0.2.2 action drop ++ ++ $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \ ++ -t ip "ttl=63" -q ++ ++ $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \ ++ -t ip "ttl=63,mf,frag=256" -q ++ ++ tc_check_packets "dev $h2 ingress" 102 1 ++ check_fail $? "Matched on the wrong filter (no check on ttl)" ++ ++ tc_check_packets "dev $h2 ingress" 101 2 ++ check_err $? "Did not match on correct filter (ttl=63)" ++ ++ $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \ ++ -t ip "ttl=255" -q ++ ++ tc_check_packets "dev $h2 ingress" 101 3 ++ check_fail $? "Matched on a wrong filter (ttl=63)" ++ ++ tc_check_packets "dev $h2 ingress" 102 1 ++ check_err $? "Did not match on correct filter (no check on ttl)" ++ ++ tc filter del dev $h2 ingress protocol ip pref 2 handle 102 flower ++ tc filter del dev $h2 ingress protocol ip pref 1 handle 101 flower ++ ++ log_test "ip_ttl match ($tcflags)" ++} ++ + match_indev_test() + { + RET=0 +-- +2.30.1 + diff --git a/queue-5.4/net-ethernet-aquantia-handle-error-cleanup-of-start-.patch b/queue-5.4/net-ethernet-aquantia-handle-error-cleanup-of-start-.patch new file mode 100644 index 00000000000..60fe0953a5b --- /dev/null +++ b/queue-5.4/net-ethernet-aquantia-handle-error-cleanup-of-start-.patch @@ -0,0 +1,50 @@ +From 7b8ea2faa64b5cc7267ff42c08c32810629b29b3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Feb 2021 05:17:57 +0000 +Subject: net: ethernet: aquantia: Handle error cleanup of start on open + +From: Nathan Rossi + +[ Upstream commit 8a28af7a3e85ddf358f8c41e401a33002f7a9587 ] + +The aq_nic_start function can fail in a variety of cases which leaves +the device in broken state. + +An example case where the start function fails is the +request_threaded_irq which can be interrupted, resulting in a EINTR +result. This can be manually triggered by bringing the link up (e.g. ip +link set up) and triggering a SIGINT on the initiating process (e.g. +Ctrl+C). This would put the device into a half configured state. +Subsequently bringing the link up again would cause the napi_enable to +BUG. + +In order to correctly clean up the failed attempt to start a device call +aq_nic_stop. + +Signed-off-by: Nathan Rossi +Reviewed-by: Igor Russkikh +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/aquantia/atlantic/aq_main.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_main.c b/drivers/net/ethernet/aquantia/atlantic/aq_main.c +index bb65dd39f847..72c7404ae6c5 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/aq_main.c ++++ b/drivers/net/ethernet/aquantia/atlantic/aq_main.c +@@ -66,8 +66,10 @@ static int aq_ndev_open(struct net_device *ndev) + goto err_exit; + + err = aq_nic_start(aq_nic); +- if (err < 0) ++ if (err < 0) { ++ aq_nic_stop(aq_nic); + goto err_exit; ++ } + + err_exit: + if (err < 0) +-- +2.30.1 + diff --git a/queue-5.4/net-introduce-can-specific-pointer-in-the-struct-net.patch b/queue-5.4/net-introduce-can-specific-pointer-in-the-struct-net.patch new file mode 100644 index 00000000000..924da6f7913 --- /dev/null +++ b/queue-5.4/net-introduce-can-specific-pointer-in-the-struct-net.patch @@ -0,0 +1,456 @@ +From 17e039be48961d4bfc5433bd9f47ce92a92e757c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Feb 2021 08:01:26 +0100 +Subject: net: introduce CAN specific pointer in the struct net_device + +From: Oleksij Rempel + +[ Upstream commit 4e096a18867a5a989b510f6999d9c6b6622e8f7b ] + +Since 20dd3850bcf8 ("can: Speed up CAN frame receiption by using +ml_priv") the CAN framework uses per device specific data in the AF_CAN +protocol. For this purpose the struct net_device->ml_priv is used. Later +the ml_priv usage in CAN was extended for other users, one of them being +CAN_J1939. + +Later in the kernel ml_priv was converted to an union, used by other +drivers. E.g. the tun driver started storing it's stats pointer. + +Since tun devices can claim to be a CAN device, CAN specific protocols +will wrongly interpret this pointer, which will cause system crashes. +Mostly this issue is visible in the CAN_J1939 stack. + +To fix this issue, we request a dedicated CAN pointer within the +net_device struct. + +Reported-by: syzbot+5138c4dd15a0401bec7b@syzkaller.appspotmail.com +Fixes: 20dd3850bcf8 ("can: Speed up CAN frame receiption by using ml_priv") +Fixes: ffd956eef69b ("can: introduce CAN midlayer private and allocate it automatically") +Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol") +Fixes: 497a5757ce4e ("tun: switch to net core provided statistics counters") +Signed-off-by: Oleksij Rempel +Link: https://lore.kernel.org/r/20210223070127.4538-1-o.rempel@pengutronix.de +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/can/dev/dev.c | 4 +++- + drivers/net/can/slcan.c | 4 +++- + drivers/net/can/vcan.c | 2 +- + drivers/net/can/vxcan.c | 6 +++++- + include/linux/can/can-ml.h | 12 ++++++++++++ + include/linux/netdevice.h | 34 +++++++++++++++++++++++++++++++++- + net/can/af_can.c | 34 ++-------------------------------- + net/can/j1939/main.c | 22 ++++++++-------------- + net/can/j1939/socket.c | 13 ++++--------- + net/can/proc.c | 19 +++++++++++++------ + 10 files changed, 84 insertions(+), 66 deletions(-) + +diff --git a/drivers/net/can/dev/dev.c b/drivers/net/can/dev/dev.c +index 1e0c1a05df82..322da89cb9c6 100644 +--- a/drivers/net/can/dev/dev.c ++++ b/drivers/net/can/dev/dev.c +@@ -718,6 +718,7 @@ EXPORT_SYMBOL_GPL(alloc_can_err_skb); + struct net_device *alloc_candev_mqs(int sizeof_priv, unsigned int echo_skb_max, + unsigned int txqs, unsigned int rxqs) + { ++ struct can_ml_priv *can_ml; + struct net_device *dev; + struct can_priv *priv; + int size; +@@ -749,7 +750,8 @@ struct net_device *alloc_candev_mqs(int sizeof_priv, unsigned int echo_skb_max, + priv = netdev_priv(dev); + priv->dev = dev; + +- dev->ml_priv = (void *)priv + ALIGN(sizeof_priv, NETDEV_ALIGN); ++ can_ml = (void *)priv + ALIGN(sizeof_priv, NETDEV_ALIGN); ++ can_set_ml_priv(dev, can_ml); + + if (echo_skb_max) { + priv->echo_skb_max = echo_skb_max; +diff --git a/drivers/net/can/slcan.c b/drivers/net/can/slcan.c +index 4dfa459ef5c7..95fefb1eef36 100644 +--- a/drivers/net/can/slcan.c ++++ b/drivers/net/can/slcan.c +@@ -519,6 +519,7 @@ static struct slcan *slc_alloc(void) + int i; + char name[IFNAMSIZ]; + struct net_device *dev = NULL; ++ struct can_ml_priv *can_ml; + struct slcan *sl; + int size; + +@@ -541,7 +542,8 @@ static struct slcan *slc_alloc(void) + + dev->base_addr = i; + sl = netdev_priv(dev); +- dev->ml_priv = (void *)sl + ALIGN(sizeof(*sl), NETDEV_ALIGN); ++ can_ml = (void *)sl + ALIGN(sizeof(*sl), NETDEV_ALIGN); ++ can_set_ml_priv(dev, can_ml); + + /* Initialize channel control data */ + sl->magic = SLCAN_MAGIC; +diff --git a/drivers/net/can/vcan.c b/drivers/net/can/vcan.c +index 39ca14b0585d..067705e2850b 100644 +--- a/drivers/net/can/vcan.c ++++ b/drivers/net/can/vcan.c +@@ -153,7 +153,7 @@ static void vcan_setup(struct net_device *dev) + dev->addr_len = 0; + dev->tx_queue_len = 0; + dev->flags = IFF_NOARP; +- dev->ml_priv = netdev_priv(dev); ++ can_set_ml_priv(dev, netdev_priv(dev)); + + /* set flags according to driver capabilities */ + if (echo) +diff --git a/drivers/net/can/vxcan.c b/drivers/net/can/vxcan.c +index b1baa4ac1d53..7000c6cd1e48 100644 +--- a/drivers/net/can/vxcan.c ++++ b/drivers/net/can/vxcan.c +@@ -141,6 +141,8 @@ static const struct net_device_ops vxcan_netdev_ops = { + + static void vxcan_setup(struct net_device *dev) + { ++ struct can_ml_priv *can_ml; ++ + dev->type = ARPHRD_CAN; + dev->mtu = CANFD_MTU; + dev->hard_header_len = 0; +@@ -149,7 +151,9 @@ static void vxcan_setup(struct net_device *dev) + dev->flags = (IFF_NOARP|IFF_ECHO); + dev->netdev_ops = &vxcan_netdev_ops; + dev->needs_free_netdev = true; +- dev->ml_priv = netdev_priv(dev) + ALIGN(sizeof(struct vxcan_priv), NETDEV_ALIGN); ++ ++ can_ml = netdev_priv(dev) + ALIGN(sizeof(struct vxcan_priv), NETDEV_ALIGN); ++ can_set_ml_priv(dev, can_ml); + } + + /* forward declaration for rtnl_create_link() */ +diff --git a/include/linux/can/can-ml.h b/include/linux/can/can-ml.h +index 2f5d731ae251..8afa92d15a66 100644 +--- a/include/linux/can/can-ml.h ++++ b/include/linux/can/can-ml.h +@@ -44,6 +44,7 @@ + + #include + #include ++#include + + #define CAN_SFF_RCV_ARRAY_SZ (1 << CAN_SFF_ID_BITS) + #define CAN_EFF_RCV_HASH_BITS 10 +@@ -65,4 +66,15 @@ struct can_ml_priv { + #endif + }; + ++static inline struct can_ml_priv *can_get_ml_priv(struct net_device *dev) ++{ ++ return netdev_get_ml_priv(dev, ML_PRIV_CAN); ++} ++ ++static inline void can_set_ml_priv(struct net_device *dev, ++ struct can_ml_priv *ml_priv) ++{ ++ netdev_set_ml_priv(dev, ml_priv, ML_PRIV_CAN); ++} ++ + #endif /* CAN_ML_H */ +diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h +index db1b9623977c..11a52f2fa35d 100644 +--- a/include/linux/netdevice.h ++++ b/include/linux/netdevice.h +@@ -1555,6 +1555,12 @@ enum netdev_priv_flags { + #define IFF_L3MDEV_RX_HANDLER IFF_L3MDEV_RX_HANDLER + #define IFF_LIVE_RENAME_OK IFF_LIVE_RENAME_OK + ++/* Specifies the type of the struct net_device::ml_priv pointer */ ++enum netdev_ml_priv_type { ++ ML_PRIV_NONE, ++ ML_PRIV_CAN, ++}; ++ + /** + * struct net_device - The DEVICE structure. + * +@@ -1732,6 +1738,7 @@ enum netdev_priv_flags { + * @nd_net: Network namespace this network device is inside + * + * @ml_priv: Mid-layer private ++ * @ml_priv_type: Mid-layer private type + * @lstats: Loopback statistics + * @tstats: Tunnel statistics + * @dstats: Dummy statistics +@@ -2019,8 +2026,10 @@ struct net_device { + possible_net_t nd_net; + + /* mid-layer private */ ++ void *ml_priv; ++ enum netdev_ml_priv_type ml_priv_type; ++ + union { +- void *ml_priv; + struct pcpu_lstats __percpu *lstats; + struct pcpu_sw_netstats __percpu *tstats; + struct pcpu_dstats __percpu *dstats; +@@ -2167,6 +2176,29 @@ static inline void netdev_reset_rx_headroom(struct net_device *dev) + netdev_set_rx_headroom(dev, -1); + } + ++static inline void *netdev_get_ml_priv(struct net_device *dev, ++ enum netdev_ml_priv_type type) ++{ ++ if (dev->ml_priv_type != type) ++ return NULL; ++ ++ return dev->ml_priv; ++} ++ ++static inline void netdev_set_ml_priv(struct net_device *dev, ++ void *ml_priv, ++ enum netdev_ml_priv_type type) ++{ ++ WARN(dev->ml_priv_type && dev->ml_priv_type != type, ++ "Overwriting already set ml_priv_type (%u) with different ml_priv_type (%u)!\n", ++ dev->ml_priv_type, type); ++ WARN(!dev->ml_priv_type && dev->ml_priv, ++ "Overwriting already set ml_priv and ml_priv_type is ML_PRIV_NONE!\n"); ++ ++ dev->ml_priv = ml_priv; ++ dev->ml_priv_type = type; ++} ++ + /* + * Net namespace inlines + */ +diff --git a/net/can/af_can.c b/net/can/af_can.c +index 306d3584a441..c758a12ffe46 100644 +--- a/net/can/af_can.c ++++ b/net/can/af_can.c +@@ -304,8 +304,8 @@ static struct can_dev_rcv_lists *can_dev_rcv_lists_find(struct net *net, + struct net_device *dev) + { + if (dev) { +- struct can_ml_priv *ml_priv = dev->ml_priv; +- return &ml_priv->dev_rcv_lists; ++ struct can_ml_priv *can_ml = can_get_ml_priv(dev); ++ return &can_ml->dev_rcv_lists; + } else { + return net->can.rx_alldev_list; + } +@@ -788,25 +788,6 @@ void can_proto_unregister(const struct can_proto *cp) + } + EXPORT_SYMBOL(can_proto_unregister); + +-/* af_can notifier to create/remove CAN netdevice specific structs */ +-static int can_notifier(struct notifier_block *nb, unsigned long msg, +- void *ptr) +-{ +- struct net_device *dev = netdev_notifier_info_to_dev(ptr); +- +- if (dev->type != ARPHRD_CAN) +- return NOTIFY_DONE; +- +- switch (msg) { +- case NETDEV_REGISTER: +- WARN(!dev->ml_priv, +- "No CAN mid layer private allocated, please fix your driver and use alloc_candev()!\n"); +- break; +- } +- +- return NOTIFY_DONE; +-} +- + static int can_pernet_init(struct net *net) + { + spin_lock_init(&net->can.rcvlists_lock); +@@ -874,11 +855,6 @@ static const struct net_proto_family can_family_ops = { + .owner = THIS_MODULE, + }; + +-/* notifier block for netdevice event */ +-static struct notifier_block can_netdev_notifier __read_mostly = { +- .notifier_call = can_notifier, +-}; +- + static struct pernet_operations can_pernet_ops __read_mostly = { + .init = can_pernet_init, + .exit = can_pernet_exit, +@@ -909,17 +885,12 @@ static __init int can_init(void) + err = sock_register(&can_family_ops); + if (err) + goto out_sock; +- err = register_netdevice_notifier(&can_netdev_notifier); +- if (err) +- goto out_notifier; + + dev_add_pack(&can_packet); + dev_add_pack(&canfd_packet); + + return 0; + +-out_notifier: +- sock_unregister(PF_CAN); + out_sock: + unregister_pernet_subsys(&can_pernet_ops); + out_pernet: +@@ -933,7 +904,6 @@ static __exit void can_exit(void) + /* protocol unregister */ + dev_remove_pack(&canfd_packet); + dev_remove_pack(&can_packet); +- unregister_netdevice_notifier(&can_netdev_notifier); + sock_unregister(PF_CAN); + + unregister_pernet_subsys(&can_pernet_ops); +diff --git a/net/can/j1939/main.c b/net/can/j1939/main.c +index 137054bff9ec..e52330f628c9 100644 +--- a/net/can/j1939/main.c ++++ b/net/can/j1939/main.c +@@ -140,9 +140,9 @@ static struct j1939_priv *j1939_priv_create(struct net_device *ndev) + static inline void j1939_priv_set(struct net_device *ndev, + struct j1939_priv *priv) + { +- struct can_ml_priv *can_ml_priv = ndev->ml_priv; ++ struct can_ml_priv *can_ml = can_get_ml_priv(ndev); + +- can_ml_priv->j1939_priv = priv; ++ can_ml->j1939_priv = priv; + } + + static void __j1939_priv_release(struct kref *kref) +@@ -211,12 +211,9 @@ static void __j1939_rx_release(struct kref *kref) + /* get pointer to priv without increasing ref counter */ + static inline struct j1939_priv *j1939_ndev_to_priv(struct net_device *ndev) + { +- struct can_ml_priv *can_ml_priv = ndev->ml_priv; ++ struct can_ml_priv *can_ml = can_get_ml_priv(ndev); + +- if (!can_ml_priv) +- return NULL; +- +- return can_ml_priv->j1939_priv; ++ return can_ml->j1939_priv; + } + + static struct j1939_priv *j1939_priv_get_by_ndev_locked(struct net_device *ndev) +@@ -225,9 +222,6 @@ static struct j1939_priv *j1939_priv_get_by_ndev_locked(struct net_device *ndev) + + lockdep_assert_held(&j1939_netdev_lock); + +- if (ndev->type != ARPHRD_CAN) +- return NULL; +- + priv = j1939_ndev_to_priv(ndev); + if (priv) + j1939_priv_get(priv); +@@ -348,15 +342,16 @@ static int j1939_netdev_notify(struct notifier_block *nb, + unsigned long msg, void *data) + { + struct net_device *ndev = netdev_notifier_info_to_dev(data); ++ struct can_ml_priv *can_ml = can_get_ml_priv(ndev); + struct j1939_priv *priv; + ++ if (!can_ml) ++ goto notify_done; ++ + priv = j1939_priv_get_by_ndev(ndev); + if (!priv) + goto notify_done; + +- if (ndev->type != ARPHRD_CAN) +- goto notify_put; +- + switch (msg) { + case NETDEV_DOWN: + j1939_cancel_active_session(priv, NULL); +@@ -365,7 +360,6 @@ static int j1939_netdev_notify(struct notifier_block *nb, + break; + } + +-notify_put: + j1939_priv_put(priv); + + notify_done: +diff --git a/net/can/j1939/socket.c b/net/can/j1939/socket.c +index 047090960539..d57475c8ba07 100644 +--- a/net/can/j1939/socket.c ++++ b/net/can/j1939/socket.c +@@ -12,6 +12,7 @@ + + #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt + ++#include + #include + #include + #include +@@ -453,6 +454,7 @@ static int j1939_sk_bind(struct socket *sock, struct sockaddr *uaddr, int len) + j1939_jsk_del(priv, jsk); + j1939_local_ecu_put(priv, jsk->addr.src_name, jsk->addr.sa); + } else { ++ struct can_ml_priv *can_ml; + struct net_device *ndev; + + ndev = dev_get_by_index(net, addr->can_ifindex); +@@ -461,15 +463,8 @@ static int j1939_sk_bind(struct socket *sock, struct sockaddr *uaddr, int len) + goto out_release_sock; + } + +- if (ndev->type != ARPHRD_CAN) { +- dev_put(ndev); +- ret = -ENODEV; +- goto out_release_sock; +- } +- +- if (!ndev->ml_priv) { +- netdev_warn_once(ndev, +- "No CAN mid layer private allocated, please fix your driver and use alloc_candev()!\n"); ++ can_ml = can_get_ml_priv(ndev); ++ if (!can_ml) { + dev_put(ndev); + ret = -ENODEV; + goto out_release_sock; +diff --git a/net/can/proc.c b/net/can/proc.c +index 077af42c26ba..a5fc63c78370 100644 +--- a/net/can/proc.c ++++ b/net/can/proc.c +@@ -329,8 +329,11 @@ static int can_rcvlist_proc_show(struct seq_file *m, void *v) + + /* receive list for registered CAN devices */ + for_each_netdev_rcu(net, dev) { +- if (dev->type == ARPHRD_CAN && dev->ml_priv) +- can_rcvlist_proc_show_one(m, idx, dev, dev->ml_priv); ++ struct can_ml_priv *can_ml = can_get_ml_priv(dev); ++ ++ if (can_ml) ++ can_rcvlist_proc_show_one(m, idx, dev, ++ &can_ml->dev_rcv_lists); + } + + rcu_read_unlock(); +@@ -382,8 +385,10 @@ static int can_rcvlist_sff_proc_show(struct seq_file *m, void *v) + + /* sff receive list for registered CAN devices */ + for_each_netdev_rcu(net, dev) { +- if (dev->type == ARPHRD_CAN && dev->ml_priv) { +- dev_rcv_lists = dev->ml_priv; ++ struct can_ml_priv *can_ml = can_get_ml_priv(dev); ++ ++ if (can_ml) { ++ dev_rcv_lists = &can_ml->dev_rcv_lists; + can_rcvlist_proc_show_array(m, dev, dev_rcv_lists->rx_sff, + ARRAY_SIZE(dev_rcv_lists->rx_sff)); + } +@@ -413,8 +418,10 @@ static int can_rcvlist_eff_proc_show(struct seq_file *m, void *v) + + /* eff receive list for registered CAN devices */ + for_each_netdev_rcu(net, dev) { +- if (dev->type == ARPHRD_CAN && dev->ml_priv) { +- dev_rcv_lists = dev->ml_priv; ++ struct can_ml_priv *can_ml = can_get_ml_priv(dev); ++ ++ if (can_ml) { ++ dev_rcv_lists = &can_ml->dev_rcv_lists; + can_rcvlist_proc_show_array(m, dev, dev_rcv_lists->rx_eff, + ARRAY_SIZE(dev_rcv_lists->rx_eff)); + } +-- +2.30.1 + diff --git a/queue-5.4/net-mvpp2-fix-interrupt-mask-unmask-skip-condition.patch b/queue-5.4/net-mvpp2-fix-interrupt-mask-unmask-skip-condition.patch new file mode 100644 index 00000000000..2d4c5f4373f --- /dev/null +++ b/queue-5.4/net-mvpp2-fix-interrupt-mask-unmask-skip-condition.patch @@ -0,0 +1,48 @@ +From a4dc5ee6f71cd1874fe84045593d2f9f8b24f8a3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Mar 2021 19:11:09 -0400 +Subject: net: mvpp2: fix interrupt mask/unmask skip condition + +[ Upstream commit 7867299cde34e9c2d2c676f2a384a9d5853b914d ] + +The condition should be skipped if CPU ID equal to nthreads. +The patch doesn't fix any actual issue since +nthreads = min_t(unsigned int, num_present_cpus(), MVPP2_MAX_THREADS). +On all current Armada platforms, the number of CPU's is +less than MVPP2_MAX_THREADS. + +Fixes: e531f76757eb ("net: mvpp2: handle cases where more CPUs are available than s/w threads") +Reported-by: Russell King +Signed-off-by: Stefan Chulski +Reviewed-by: Russell King +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c +index 9a77b70ad601..491bcfd36ac2 100644 +--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c ++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c +@@ -1073,7 +1073,7 @@ static void mvpp2_interrupts_unmask(void *arg) + u32 val; + + /* If the thread isn't used, don't do anything */ +- if (smp_processor_id() > port->priv->nthreads) ++ if (smp_processor_id() >= port->priv->nthreads) + return; + + val = MVPP2_CAUSE_MISC_SUM_MASK | +@@ -2078,7 +2078,7 @@ static void mvpp2_txq_sent_counter_clear(void *arg) + int queue; + + /* If the thread isn't used, don't do anything */ +- if (smp_processor_id() > port->priv->nthreads) ++ if (smp_processor_id() >= port->priv->nthreads) + return; + + for (queue = 0; queue < port->ntxqs; queue++) { +-- +2.30.1 + diff --git a/queue-5.4/net-wan-lmc-unregister-device-when-no-matching-devic.patch b/queue-5.4/net-wan-lmc-unregister-device-when-no-matching-devic.patch new file mode 100644 index 00000000000..5e00ffca2dd --- /dev/null +++ b/queue-5.4/net-wan-lmc-unregister-device-when-no-matching-devic.patch @@ -0,0 +1,96 @@ +From 61e649af3de9f2a1d79bf211b030412d891c2e50 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Feb 2021 14:17:56 -0500 +Subject: net: wan/lmc: unregister device when no matching device is found + +From: Tong Zhang + +[ Upstream commit 62e69bc419772638369eff8ff81340bde8aceb61 ] + +lmc set sc->lmc_media pointer when there is a matching device. +However, when no matching device is found, this pointer is NULL +and the following dereference will result in a null-ptr-deref. + +To fix this issue, unregister the hdlc device and return an error. + +[ 4.569359] BUG: KASAN: null-ptr-deref in lmc_init_one.cold+0x2b6/0x55d [lmc] +[ 4.569748] Read of size 8 at addr 0000000000000008 by task modprobe/95 +[ 4.570102] +[ 4.570187] CPU: 0 PID: 95 Comm: modprobe Not tainted 5.11.0-rc7 #94 +[ 4.570527] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-48-gd9c812dda519-preb4 +[ 4.571125] Call Trace: +[ 4.571261] dump_stack+0x7d/0xa3 +[ 4.571445] kasan_report.cold+0x10c/0x10e +[ 4.571667] ? lmc_init_one.cold+0x2b6/0x55d [lmc] +[ 4.571932] lmc_init_one.cold+0x2b6/0x55d [lmc] +[ 4.572186] ? lmc_mii_readreg+0xa0/0xa0 [lmc] +[ 4.572432] local_pci_probe+0x6f/0xb0 +[ 4.572639] pci_device_probe+0x171/0x240 +[ 4.572857] ? pci_device_remove+0xe0/0xe0 +[ 4.573080] ? kernfs_create_link+0xb6/0x110 +[ 4.573315] ? sysfs_do_create_link_sd.isra.0+0x76/0xe0 +[ 4.573598] really_probe+0x161/0x420 +[ 4.573799] driver_probe_device+0x6d/0xd0 +[ 4.574022] device_driver_attach+0x82/0x90 +[ 4.574249] ? device_driver_attach+0x90/0x90 +[ 4.574485] __driver_attach+0x60/0x100 +[ 4.574694] ? device_driver_attach+0x90/0x90 +[ 4.574931] bus_for_each_dev+0xe1/0x140 +[ 4.575146] ? subsys_dev_iter_exit+0x10/0x10 +[ 4.575387] ? klist_node_init+0x61/0x80 +[ 4.575602] bus_add_driver+0x254/0x2a0 +[ 4.575812] driver_register+0xd3/0x150 +[ 4.576021] ? 0xffffffffc0018000 +[ 4.576202] do_one_initcall+0x84/0x250 +[ 4.576411] ? trace_event_raw_event_initcall_finish+0x150/0x150 +[ 4.576733] ? unpoison_range+0xf/0x30 +[ 4.576938] ? ____kasan_kmalloc.constprop.0+0x84/0xa0 +[ 4.577219] ? unpoison_range+0xf/0x30 +[ 4.577423] ? unpoison_range+0xf/0x30 +[ 4.577628] do_init_module+0xf8/0x350 +[ 4.577833] load_module+0x3fe6/0x4340 +[ 4.578038] ? vm_unmap_ram+0x1d0/0x1d0 +[ 4.578247] ? ____kasan_kmalloc.constprop.0+0x84/0xa0 +[ 4.578526] ? module_frob_arch_sections+0x20/0x20 +[ 4.578787] ? __do_sys_finit_module+0x108/0x170 +[ 4.579037] __do_sys_finit_module+0x108/0x170 +[ 4.579278] ? __ia32_sys_init_module+0x40/0x40 +[ 4.579523] ? file_open_root+0x200/0x200 +[ 4.579742] ? do_sys_open+0x85/0xe0 +[ 4.579938] ? filp_open+0x50/0x50 +[ 4.580125] ? exit_to_user_mode_prepare+0xfc/0x130 +[ 4.580390] do_syscall_64+0x33/0x40 +[ 4.580586] entry_SYSCALL_64_after_hwframe+0x44/0xa9 +[ 4.580859] RIP: 0033:0x7f1a724c3cf7 +[ 4.581054] Code: 48 89 57 30 48 8b 04 24 48 89 47 38 e9 1d a0 02 00 48 89 f8 48 89 f7 48 89 d6 48 891 +[ 4.582043] RSP: 002b:00007fff44941c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 +[ 4.582447] RAX: ffffffffffffffda RBX: 00000000012ada70 RCX: 00007f1a724c3cf7 +[ 4.582827] RDX: 0000000000000000 RSI: 00000000012ac9e0 RDI: 0000000000000003 +[ 4.583207] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000001 +[ 4.583587] R10: 00007f1a72527300 R11: 0000000000000246 R12: 00000000012ac9e0 +[ 4.583968] R13: 0000000000000000 R14: 00000000012acc90 R15: 0000000000000001 +[ 4.584349] ================================================================== + +Signed-off-by: Tong Zhang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/wan/lmc/lmc_main.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/wan/lmc/lmc_main.c b/drivers/net/wan/lmc/lmc_main.c +index 0e6a51525d91..f3deb2a2fa47 100644 +--- a/drivers/net/wan/lmc/lmc_main.c ++++ b/drivers/net/wan/lmc/lmc_main.c +@@ -912,6 +912,8 @@ static int lmc_init_one(struct pci_dev *pdev, const struct pci_device_id *ent) + break; + default: + printk(KERN_WARNING "%s: LMC UNKNOWN CARD!\n", dev->name); ++ unregister_hdlc_device(dev); ++ return -EIO; + break; + } + +-- +2.30.1 + diff --git a/queue-5.4/series b/queue-5.4/series index 99430f74a6e..4f39b47a970 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -27,3 +27,13 @@ asoc-rt5659-update-mclk-rate-in-set_sysclk.patch thermal-core-add-null-pointer-check-before-using-coo.patch locking-ww_mutex-simplify-use_ww_ctx-ww_ctx-handling.patch ext4-do-not-iput-inode-under-running-transaction-in-.patch +net-mvpp2-fix-interrupt-mask-unmask-skip-condition.patch +flow_dissector-fix-ttl-and-tos-dissection-on-ipv4-fr.patch +can-dev-move-driver-related-infrastructure-into-sepa.patch +net-introduce-can-specific-pointer-in-the-struct-net.patch +can-tcan4x5x-fix-max-register-value.patch +brcmfmac-clear-eap-association-status-bits-on-linkdo.patch +ath10k-hold-rcu-lock-when-calling-ieee80211_find_sta.patch +net-ethernet-aquantia-handle-error-cleanup-of-start-.patch +appletalk-fix-skb-allocation-size-in-loopback-case.patch +net-wan-lmc-unregister-device-when-no-matching-devic.patch