From: Sasha Levin Date: Wed, 5 Jun 2024 12:09:33 +0000 (-0400) Subject: Fixes for 4.19 X-Git-Tag: v6.1.93~39 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=0fffe0253cc4b73a118ad5b6350ac0c542ecf46e;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 4.19 Signed-off-by: Sasha Levin --- diff --git a/queue-4.19/dma-buf-sw-sync-don-t-enable-irq-from-sync_print_obj.patch b/queue-4.19/dma-buf-sw-sync-don-t-enable-irq-from-sync_print_obj.patch new file mode 100644 index 00000000000..cee45b62834 --- /dev/null +++ b/queue-4.19/dma-buf-sw-sync-don-t-enable-irq-from-sync_print_obj.patch @@ -0,0 +1,55 @@ +From b6b4d8436194a4d3fc9ce8135f75d01fca253313 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 5 May 2024 23:08:31 +0900 +Subject: dma-buf/sw-sync: don't enable IRQ from sync_print_obj() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Tetsuo Handa + +[ Upstream commit b794918961516f667b0c745aebdfebbb8a98df39 ] + +Since commit a6aa8fca4d79 ("dma-buf/sw-sync: Reduce irqsave/irqrestore from +known context") by error replaced spin_unlock_irqrestore() with +spin_unlock_irq() for both sync_debugfs_show() and sync_print_obj() despite +sync_print_obj() is called from sync_debugfs_show(), lockdep complains +inconsistent lock state warning. + +Use plain spin_{lock,unlock}() for sync_print_obj(), for +sync_debugfs_show() is already using spin_{lock,unlock}_irq(). + +Reported-by: syzbot +Closes: https://syzkaller.appspot.com/bug?extid=a225ee3df7e7f9372dbe +Fixes: a6aa8fca4d79 ("dma-buf/sw-sync: Reduce irqsave/irqrestore from known context") +Signed-off-by: Tetsuo Handa +Reviewed-by: Christian König +Link: https://patchwork.freedesktop.org/patch/msgid/c2e46020-aaa6-4e06-bf73-f05823f913f0@I-love.SAKURA.ne.jp +Signed-off-by: Christian König +Signed-off-by: Sasha Levin +--- + drivers/dma-buf/sync_debug.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/dma-buf/sync_debug.c b/drivers/dma-buf/sync_debug.c +index c4c8ecb24aa9b..cfe31e52d78d8 100644 +--- a/drivers/dma-buf/sync_debug.c ++++ b/drivers/dma-buf/sync_debug.c +@@ -119,12 +119,12 @@ static void sync_print_obj(struct seq_file *s, struct sync_timeline *obj) + + seq_printf(s, "%s: %d\n", obj->name, obj->value); + +- spin_lock_irq(&obj->lock); ++ spin_lock(&obj->lock); /* Caller already disabled IRQ. */ + list_for_each(pos, &obj->pt_list) { + struct sync_pt *pt = container_of(pos, struct sync_pt, link); + sync_print_fence(s, &pt->base, false); + } +- spin_unlock_irq(&obj->lock); ++ spin_unlock(&obj->lock); + } + + static void sync_print_sync_file(struct seq_file *s, +-- +2.43.0 + diff --git a/queue-4.19/enic-validate-length-of-nl-attributes-in-enic_set_vf.patch b/queue-4.19/enic-validate-length-of-nl-attributes-in-enic_set_vf.patch new file mode 100644 index 00000000000..571878bc2ae --- /dev/null +++ b/queue-4.19/enic-validate-length-of-nl-attributes-in-enic_set_vf.patch @@ -0,0 +1,69 @@ +From 268d420022668357df586a876adc18ff2dbb6b14 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 May 2024 10:30:44 +0300 +Subject: enic: Validate length of nl attributes in enic_set_vf_port + +From: Roded Zats + +[ Upstream commit e8021b94b0412c37bcc79027c2e382086b6ce449 ] + +enic_set_vf_port assumes that the nl attribute IFLA_PORT_PROFILE +is of length PORT_PROFILE_MAX and that the nl attributes +IFLA_PORT_INSTANCE_UUID, IFLA_PORT_HOST_UUID are of length PORT_UUID_MAX. +These attributes are validated (in the function do_setlink in rtnetlink.c) +using the nla_policy ifla_port_policy. The policy defines IFLA_PORT_PROFILE +as NLA_STRING, IFLA_PORT_INSTANCE_UUID as NLA_BINARY and +IFLA_PORT_HOST_UUID as NLA_STRING. That means that the length validation +using the policy is for the max size of the attributes and not on exact +size so the length of these attributes might be less than the sizes that +enic_set_vf_port expects. This might cause an out of bands +read access in the memcpys of the data of these +attributes in enic_set_vf_port. + +Fixes: f8bd909183ac ("net: Add ndo_{set|get}_vf_port support for enic dynamic vnics") +Signed-off-by: Roded Zats +Link: https://lore.kernel.org/r/20240522073044.33519-1-rzats@paloaltonetworks.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/cisco/enic/enic_main.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c +index bfe0e820956ca..6ad1734d96777 100644 +--- a/drivers/net/ethernet/cisco/enic/enic_main.c ++++ b/drivers/net/ethernet/cisco/enic/enic_main.c +@@ -1152,18 +1152,30 @@ static int enic_set_vf_port(struct net_device *netdev, int vf, + pp->request = nla_get_u8(port[IFLA_PORT_REQUEST]); + + if (port[IFLA_PORT_PROFILE]) { ++ if (nla_len(port[IFLA_PORT_PROFILE]) != PORT_PROFILE_MAX) { ++ memcpy(pp, &prev_pp, sizeof(*pp)); ++ return -EINVAL; ++ } + pp->set |= ENIC_SET_NAME; + memcpy(pp->name, nla_data(port[IFLA_PORT_PROFILE]), + PORT_PROFILE_MAX); + } + + if (port[IFLA_PORT_INSTANCE_UUID]) { ++ if (nla_len(port[IFLA_PORT_INSTANCE_UUID]) != PORT_UUID_MAX) { ++ memcpy(pp, &prev_pp, sizeof(*pp)); ++ return -EINVAL; ++ } + pp->set |= ENIC_SET_INSTANCE; + memcpy(pp->instance_uuid, + nla_data(port[IFLA_PORT_INSTANCE_UUID]), PORT_UUID_MAX); + } + + if (port[IFLA_PORT_HOST_UUID]) { ++ if (nla_len(port[IFLA_PORT_HOST_UUID]) != PORT_UUID_MAX) { ++ memcpy(pp, &prev_pp, sizeof(*pp)); ++ return -EINVAL; ++ } + pp->set |= ENIC_SET_HOST; + memcpy(pp->host_uuid, + nla_data(port[IFLA_PORT_HOST_UUID]), PORT_UUID_MAX); +-- +2.43.0 + diff --git a/queue-4.19/ipvlan-dont-use-skb-sk-in-ipvlan_process_v-4-6-_outb.patch b/queue-4.19/ipvlan-dont-use-skb-sk-in-ipvlan_process_v-4-6-_outb.patch new file mode 100644 index 00000000000..154ddd5705b --- /dev/null +++ b/queue-4.19/ipvlan-dont-use-skb-sk-in-ipvlan_process_v-4-6-_outb.patch @@ -0,0 +1,107 @@ +From e54dead980606bf976b6b91376fccbd6b7671b45 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 May 2024 17:56:33 +0800 +Subject: ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound + +From: Yue Haibing + +[ Upstream commit b3dc6e8003b500861fa307e9a3400c52e78e4d3a ] + +Raw packet from PF_PACKET socket ontop of an IPv6-backed ipvlan device will +hit WARN_ON_ONCE() in sk_mc_loop() through sch_direct_xmit() path. + +WARNING: CPU: 2 PID: 0 at net/core/sock.c:775 sk_mc_loop+0x2d/0x70 +Modules linked in: sch_netem ipvlan rfkill cirrus drm_shmem_helper sg drm_kms_helper +CPU: 2 PID: 0 Comm: swapper/2 Kdump: loaded Not tainted 6.9.0+ #279 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 +RIP: 0010:sk_mc_loop+0x2d/0x70 +Code: fa 0f 1f 44 00 00 65 0f b7 15 f7 96 a3 4f 31 c0 66 85 d2 75 26 48 85 ff 74 1c +RSP: 0018:ffffa9584015cd78 EFLAGS: 00010212 +RAX: 0000000000000011 RBX: ffff91e585793e00 RCX: 0000000002c6a001 +RDX: 0000000000000000 RSI: 0000000000000040 RDI: ffff91e589c0f000 +RBP: ffff91e5855bd100 R08: 0000000000000000 R09: 3d00545216f43d00 +R10: ffff91e584fdcc50 R11: 00000060dd8616f4 R12: ffff91e58132d000 +R13: ffff91e584fdcc68 R14: ffff91e5869ce800 R15: ffff91e589c0f000 +FS: 0000000000000000(0000) GS:ffff91e898100000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 00007f788f7c44c0 CR3: 0000000008e1a000 CR4: 00000000000006f0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +Call Trace: + + ? __warn (kernel/panic.c:693) + ? sk_mc_loop (net/core/sock.c:760) + ? report_bug (lib/bug.c:201 lib/bug.c:219) + ? handle_bug (arch/x86/kernel/traps.c:239) + ? exc_invalid_op (arch/x86/kernel/traps.c:260 (discriminator 1)) + ? asm_exc_invalid_op (./arch/x86/include/asm/idtentry.h:621) + ? sk_mc_loop (net/core/sock.c:760) + ip6_finish_output2 (net/ipv6/ip6_output.c:83 (discriminator 1)) + ? nf_hook_slow (net/netfilter/core.c:626) + ip6_finish_output (net/ipv6/ip6_output.c:222) + ? __pfx_ip6_finish_output (net/ipv6/ip6_output.c:215) + ipvlan_xmit_mode_l3 (drivers/net/ipvlan/ipvlan_core.c:602) ipvlan + ipvlan_start_xmit (drivers/net/ipvlan/ipvlan_main.c:226) ipvlan + dev_hard_start_xmit (net/core/dev.c:3594) + sch_direct_xmit (net/sched/sch_generic.c:343) + __qdisc_run (net/sched/sch_generic.c:416) + net_tx_action (net/core/dev.c:5286) + handle_softirqs (kernel/softirq.c:555) + __irq_exit_rcu (kernel/softirq.c:589) + sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1043) + +The warning triggers as this: +packet_sendmsg + packet_snd //skb->sk is packet sk + __dev_queue_xmit + __dev_xmit_skb //q->enqueue is not NULL + __qdisc_run + sch_direct_xmit + dev_hard_start_xmit + ipvlan_start_xmit + ipvlan_xmit_mode_l3 //l3 mode + ipvlan_process_outbound //vepa flag + ipvlan_process_v6_outbound + ip6_local_out + __ip6_finish_output + ip6_finish_output2 //multicast packet + sk_mc_loop //sk->sk_family is AF_PACKET + +Call ip{6}_local_out() with NULL sk in ipvlan as other tunnels to fix this. + +Fixes: 2ad7bf363841 ("ipvlan: Initial check-in of the IPVLAN driver.") +Suggested-by: Eric Dumazet +Signed-off-by: Yue Haibing +Reviewed-by: Eric Dumazet +Link: https://lore.kernel.org/r/20240529095633.613103-1-yuehaibing@huawei.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ipvlan/ipvlan_core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ipvlan/ipvlan_core.c b/drivers/net/ipvlan/ipvlan_core.c +index 34126abb28d8d..f08fdcc1bfb39 100644 +--- a/drivers/net/ipvlan/ipvlan_core.c ++++ b/drivers/net/ipvlan/ipvlan_core.c +@@ -446,7 +446,7 @@ static noinline_for_stack int ipvlan_process_v4_outbound(struct sk_buff *skb) + + memset(IPCB(skb), 0, sizeof(*IPCB(skb))); + +- err = ip_local_out(net, skb->sk, skb); ++ err = ip_local_out(net, NULL, skb); + if (unlikely(net_xmit_eval(err))) + DEV_STATS_INC(dev, tx_errors); + else +@@ -501,7 +501,7 @@ static int ipvlan_process_v6_outbound(struct sk_buff *skb) + + memset(IP6CB(skb), 0, sizeof(*IP6CB(skb))); + +- err = ip6_local_out(dev_net(dev), skb->sk, skb); ++ err = ip6_local_out(dev_net(dev), NULL, skb); + if (unlikely(net_xmit_eval(err))) + DEV_STATS_INC(dev, tx_errors); + else +-- +2.43.0 + diff --git a/queue-4.19/kconfig-fix-comparison-to-constant-symbols-m-n.patch b/queue-4.19/kconfig-fix-comparison-to-constant-symbols-m-n.patch new file mode 100644 index 00000000000..f78ce6e2ac3 --- /dev/null +++ b/queue-4.19/kconfig-fix-comparison-to-constant-symbols-m-n.patch @@ -0,0 +1,124 @@ +From a159568f6310724b0d9662677252ea11908938a1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 19 May 2024 18:22:27 +0900 +Subject: kconfig: fix comparison to constant symbols, 'm', 'n' + +From: Masahiro Yamada + +[ Upstream commit aabdc960a283ba78086b0bf66ee74326f49e218e ] + +Currently, comparisons to 'm' or 'n' result in incorrect output. + +[Test Code] + + config MODULES + def_bool y + modules + + config A + def_tristate m + + config B + def_bool A > n + +CONFIG_B is unset, while CONFIG_B=y is expected. + +The reason for the issue is because Kconfig compares the tristate values +as strings. + +Currently, the .type fields in the constant symbol definitions, +symbol_{yes,mod,no} are unspecified, i.e., S_UNKNOWN. + +When expr_calc_value() evaluates 'A > n', it checks the types of 'A' and +'n' to determine how to compare them. + +The left-hand side, 'A', is a tristate symbol with a value of 'm', which +corresponds to a numeric value of 1. (Internally, 'y', 'm', and 'n' are +represented as 2, 1, and 0, respectively.) + +The right-hand side, 'n', has an unknown type, so it is treated as the +string "n" during the comparison. + +expr_calc_value() compares two values numerically only when both can +have numeric values. Otherwise, they are compared as strings. + + symbol numeric value ASCII code + ------------------------------------- + y 2 0x79 + m 1 0x6d + n 0 0x6e + +'m' is greater than 'n' if compared numerically (since 1 is greater +than 0), but smaller than 'n' if compared as strings (since the ASCII +code 0x6d is smaller than 0x6e). + +Specifying .type=S_TRISTATE for symbol_{yes,mod,no} fixes the above +test code. + +Doing so, however, would cause a regression to the following test code. + +[Test Code 2] + + config MODULES + def_bool n + modules + + config A + def_tristate n + + config B + def_bool A = m + +You would get CONFIG_B=y, while CONFIG_B should not be set. + +The reason is because sym_get_string_value() turns 'm' into 'n' when the +module feature is disabled. Consequently, expr_calc_value() evaluates +'A = n' instead of 'A = m'. This oddity has been hidden because the type +of 'm' was previously S_UNKNOWN instead of S_TRISTATE. + +sym_get_string_value() should not tweak the string because the tristate +value has already been correctly calculated. There is no reason to +return the string "n" where its tristate value is mod. + +Fixes: 31847b67bec0 ("kconfig: allow use of relations other than (in)equality") +Signed-off-by: Masahiro Yamada +Signed-off-by: Sasha Levin +--- + scripts/kconfig/symbol.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/scripts/kconfig/symbol.c b/scripts/kconfig/symbol.c +index 5adb60b7e12f3..a28f4af4da2f3 100644 +--- a/scripts/kconfig/symbol.c ++++ b/scripts/kconfig/symbol.c +@@ -13,14 +13,17 @@ + + struct symbol symbol_yes = { + .name = "y", ++ .type = S_TRISTATE, + .curr = { "y", yes }, + .flags = SYMBOL_CONST|SYMBOL_VALID, + }, symbol_mod = { + .name = "m", ++ .type = S_TRISTATE, + .curr = { "m", mod }, + .flags = SYMBOL_CONST|SYMBOL_VALID, + }, symbol_no = { + .name = "n", ++ .type = S_TRISTATE, + .curr = { "n", no }, + .flags = SYMBOL_CONST|SYMBOL_VALID, + }, symbol_empty = { +@@ -774,8 +777,7 @@ const char *sym_get_string_value(struct symbol *sym) + case no: + return "n"; + case mod: +- sym_calc_value(modules_sym); +- return (modules_sym->curr.tri == no) ? "n" : "m"; ++ return "m"; + case yes: + return "y"; + } +-- +2.43.0 + diff --git a/queue-4.19/net-fec-add-fec_enet_deinit.patch b/queue-4.19/net-fec-add-fec_enet_deinit.patch new file mode 100644 index 00000000000..1cee2679b58 --- /dev/null +++ b/queue-4.19/net-fec-add-fec_enet_deinit.patch @@ -0,0 +1,63 @@ +From 9b70f4fb4a299da078df51fc07990ee87a1735fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 May 2024 13:05:28 +0800 +Subject: net:fec: Add fec_enet_deinit() + +From: Xiaolei Wang + +[ Upstream commit bf0497f53c8535f99b72041529d3f7708a6e2c0d ] + +When fec_probe() fails or fec_drv_remove() needs to release the +fec queue and remove a NAPI context, therefore add a function +corresponding to fec_enet_init() and call fec_enet_deinit() which +does the opposite to release memory and remove a NAPI context. + +Fixes: 59d0f7465644 ("net: fec: init multi queue date structure") +Signed-off-by: Xiaolei Wang +Reviewed-by: Wei Fang +Reviewed-by: Andrew Lunn +Link: https://lore.kernel.org/r/20240524050528.4115581-1-xiaolei.wang@windriver.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/fec_main.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c +index 9c4c892bfc837..35593b41e6c12 100644 +--- a/drivers/net/ethernet/freescale/fec_main.c ++++ b/drivers/net/ethernet/freescale/fec_main.c +@@ -3320,6 +3320,14 @@ static int fec_enet_init(struct net_device *ndev) + return ret; + } + ++static void fec_enet_deinit(struct net_device *ndev) ++{ ++ struct fec_enet_private *fep = netdev_priv(ndev); ++ ++ netif_napi_del(&fep->napi); ++ fec_enet_free_queue(ndev); ++} ++ + #ifdef CONFIG_OF + static int fec_reset_phy(struct platform_device *pdev) + { +@@ -3687,6 +3695,7 @@ fec_probe(struct platform_device *pdev) + fec_enet_mii_remove(fep); + failed_mii_init: + failed_irq: ++ fec_enet_deinit(ndev); + failed_init: + fec_ptp_stop(pdev); + failed_reset: +@@ -3748,6 +3757,7 @@ fec_drv_remove(struct platform_device *pdev) + pm_runtime_put_noidle(&pdev->dev); + pm_runtime_disable(&pdev->dev); + ++ fec_enet_deinit(ndev); + free_netdev(ndev); + return 0; + } +-- +2.43.0 + diff --git a/queue-4.19/net-mlx5e-use-rx_missed_errors-instead-of-rx_dropped.patch b/queue-4.19/net-mlx5e-use-rx_missed_errors-instead-of-rx_dropped.patch new file mode 100644 index 00000000000..fbe5c0bafb9 --- /dev/null +++ b/queue-4.19/net-mlx5e-use-rx_missed_errors-instead-of-rx_dropped.patch @@ -0,0 +1,46 @@ +From 317cdec09d9c6d401f08e6d900f6503bf2da95fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 May 2024 22:26:58 +0300 +Subject: net/mlx5e: Use rx_missed_errors instead of rx_dropped for reporting + buffer exhaustion + +From: Carolina Jubran + +[ Upstream commit 5c74195d5dd977e97556e6fa76909b831c241230 ] + +Previously, the driver incorrectly used rx_dropped to report device +buffer exhaustion. + +According to the documentation, rx_dropped should not be used to count +packets dropped due to buffer exhaustion, which is the purpose of +rx_missed_errors. + +Use rx_missed_errors as intended for counting packets dropped due to +buffer exhaustion. + +Fixes: 269e6b3af3bf ("net/mlx5e: Report additional error statistics in get stats ndo") +Signed-off-by: Carolina Jubran +Signed-off-by: Tariq Toukan +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +index 6ecb92f55e974..6dd1ee76887ad 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +@@ -3476,7 +3476,7 @@ mlx5e_get_stats(struct net_device *dev, struct rtnl_link_stats64 *stats) + stats->tx_dropped = sstats->tx_queue_dropped; + } + +- stats->rx_dropped = priv->stats.qcnt.rx_out_of_buffer; ++ stats->rx_missed_errors = priv->stats.qcnt.rx_out_of_buffer; + + stats->rx_length_errors = + PPORT_802_3_GET(pstats, a_in_range_length_errors) + +-- +2.43.0 + diff --git a/queue-4.19/net-usb-smsc95xx-fix-changing-led_sel-bit-value-upda.patch b/queue-4.19/net-usb-smsc95xx-fix-changing-led_sel-bit-value-upda.patch new file mode 100644 index 00000000000..ee86e3b37fc --- /dev/null +++ b/queue-4.19/net-usb-smsc95xx-fix-changing-led_sel-bit-value-upda.patch @@ -0,0 +1,68 @@ +From b503084f564f320f3218ed51a05b4cb1ad8fae4a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 May 2024 14:23:14 +0530 +Subject: net: usb: smsc95xx: fix changing LED_SEL bit value updated from + EEPROM + +From: Parthiban Veerasooran + +[ Upstream commit 52a2f0608366a629d43dacd3191039c95fef74ba ] + +LED Select (LED_SEL) bit in the LED General Purpose IO Configuration +register is used to determine the functionality of external LED pins +(Speed Indicator, Link and Activity Indicator, Full Duplex Link +Indicator). The default value for this bit is 0 when no EEPROM is +present. If a EEPROM is present, the default value is the value of the +LED Select bit in the Configuration Flags of the EEPROM. A USB Reset or +Lite Reset (LRST) will cause this bit to be restored to the image value +last loaded from EEPROM, or to be set to 0 if no EEPROM is present. + +While configuring the dual purpose GPIO/LED pins to LED outputs in the +LED General Purpose IO Configuration register, the LED_SEL bit is changed +as 0 and resulting the configured value from the EEPROM is cleared. The +issue is fixed by using read-modify-write approach. + +Fixes: f293501c61c5 ("smsc95xx: configure LED outputs") +Signed-off-by: Parthiban Veerasooran +Reviewed-by: Simon Horman +Reviewed-by: Woojung Huh +Link: https://lore.kernel.org/r/20240523085314.167650-1-Parthiban.Veerasooran@microchip.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/usb/smsc95xx.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c +index ec233d033f5cd..22c1eac73f2c4 100644 +--- a/drivers/net/usb/smsc95xx.c ++++ b/drivers/net/usb/smsc95xx.c +@@ -1036,7 +1036,7 @@ static int smsc95xx_phy_initialize(struct usbnet *dev) + static int smsc95xx_reset(struct usbnet *dev) + { + struct smsc95xx_priv *pdata = dev->driver_priv; +- u32 read_buf, write_buf, burst_cap; ++ u32 read_buf, burst_cap; + int ret = 0, timeout; + + netif_dbg(dev, ifup, dev->net, "entering smsc95xx_reset\n"); +@@ -1178,10 +1178,13 @@ static int smsc95xx_reset(struct usbnet *dev) + return ret; + netif_dbg(dev, ifup, dev->net, "ID_REV = 0x%08x\n", read_buf); + ++ ret = smsc95xx_read_reg(dev, LED_GPIO_CFG, &read_buf); ++ if (ret < 0) ++ return ret; + /* Configure GPIO pins as LED outputs */ +- write_buf = LED_GPIO_CFG_SPD_LED | LED_GPIO_CFG_LNK_LED | +- LED_GPIO_CFG_FDX_LED; +- ret = smsc95xx_write_reg(dev, LED_GPIO_CFG, write_buf); ++ read_buf |= LED_GPIO_CFG_SPD_LED | LED_GPIO_CFG_LNK_LED | ++ LED_GPIO_CFG_FDX_LED; ++ ret = smsc95xx_write_reg(dev, LED_GPIO_CFG, read_buf); + if (ret < 0) + return ret; + +-- +2.43.0 + diff --git a/queue-4.19/netfilter-nfnetlink_queue-acquire-rcu_read_lock-in-i.patch b/queue-4.19/netfilter-nfnetlink_queue-acquire-rcu_read_lock-in-i.patch new file mode 100644 index 00000000000..1920a78cc4d --- /dev/null +++ b/queue-4.19/netfilter-nfnetlink_queue-acquire-rcu_read_lock-in-i.patch @@ -0,0 +1,79 @@ +From 08654c7df1eae5d783ef6b293f4876945c3bba86 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 May 2024 13:23:39 +0000 +Subject: netfilter: nfnetlink_queue: acquire rcu_read_lock() in + instance_destroy_rcu() + +From: Eric Dumazet + +[ Upstream commit dc21c6cc3d6986d938efbf95de62473982c98dec ] + +syzbot reported that nf_reinject() could be called without rcu_read_lock() : + +WARNING: suspicious RCU usage +6.9.0-rc7-syzkaller-02060-g5c1672705a1a #0 Not tainted + +net/netfilter/nfnetlink_queue.c:263 suspicious rcu_dereference_check() usage! + +other info that might help us debug this: + +rcu_scheduler_active = 2, debug_locks = 1 +2 locks held by syz-executor.4/13427: + #0: ffffffff8e334f60 (rcu_callback){....}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:329 [inline] + #0: ffffffff8e334f60 (rcu_callback){....}-{0:0}, at: rcu_do_batch kernel/rcu/tree.c:2190 [inline] + #0: ffffffff8e334f60 (rcu_callback){....}-{0:0}, at: rcu_core+0xa86/0x1830 kernel/rcu/tree.c:2471 + #1: ffff88801ca92958 (&inst->lock){+.-.}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:356 [inline] + #1: ffff88801ca92958 (&inst->lock){+.-.}-{2:2}, at: nfqnl_flush net/netfilter/nfnetlink_queue.c:405 [inline] + #1: ffff88801ca92958 (&inst->lock){+.-.}-{2:2}, at: instance_destroy_rcu+0x30/0x220 net/netfilter/nfnetlink_queue.c:172 + +stack backtrace: +CPU: 0 PID: 13427 Comm: syz-executor.4 Not tainted 6.9.0-rc7-syzkaller-02060-g5c1672705a1a #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024 +Call Trace: + + __dump_stack lib/dump_stack.c:88 [inline] + dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 + lockdep_rcu_suspicious+0x221/0x340 kernel/locking/lockdep.c:6712 + nf_reinject net/netfilter/nfnetlink_queue.c:323 [inline] + nfqnl_reinject+0x6ec/0x1120 net/netfilter/nfnetlink_queue.c:397 + nfqnl_flush net/netfilter/nfnetlink_queue.c:410 [inline] + instance_destroy_rcu+0x1ae/0x220 net/netfilter/nfnetlink_queue.c:172 + rcu_do_batch kernel/rcu/tree.c:2196 [inline] + rcu_core+0xafd/0x1830 kernel/rcu/tree.c:2471 + handle_softirqs+0x2d6/0x990 kernel/softirq.c:554 + __do_softirq kernel/softirq.c:588 [inline] + invoke_softirq kernel/softirq.c:428 [inline] + __irq_exit_rcu+0xf4/0x1c0 kernel/softirq.c:637 + irq_exit_rcu+0x9/0x30 kernel/softirq.c:649 + instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline] + sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043 + + + +Fixes: 9872bec773c2 ("[NETFILTER]: nfnetlink: use RCU for queue instances hash") +Reported-by: syzbot +Signed-off-by: Eric Dumazet +Acked-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nfnetlink_queue.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c +index 1aacc31a6bf92..6ed2be4ac88eb 100644 +--- a/net/netfilter/nfnetlink_queue.c ++++ b/net/netfilter/nfnetlink_queue.c +@@ -171,7 +171,9 @@ instance_destroy_rcu(struct rcu_head *head) + struct nfqnl_instance *inst = container_of(head, struct nfqnl_instance, + rcu); + ++ rcu_read_lock(); + nfqnl_flush(inst, NULL, 0); ++ rcu_read_unlock(); + kfree(inst); + module_put(THIS_MODULE); + } +-- +2.43.0 + diff --git a/queue-4.19/nvmet-fix-ns-enable-disable-possible-hang.patch b/queue-4.19/nvmet-fix-ns-enable-disable-possible-hang.patch new file mode 100644 index 00000000000..7f51f56b3f9 --- /dev/null +++ b/queue-4.19/nvmet-fix-ns-enable-disable-possible-hang.patch @@ -0,0 +1,59 @@ +From ceee6edf6e2bcf0ce44e4f89ebf1c11b19ec188f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 May 2024 23:20:28 +0300 +Subject: nvmet: fix ns enable/disable possible hang + +From: Sagi Grimberg + +[ Upstream commit f97914e35fd98b2b18fb8a092e0a0799f73afdfe ] + +When disabling an nvmet namespace, there is a period where the +subsys->lock is released, as the ns disable waits for backend IO to +complete, and the ns percpu ref to be properly killed. The original +intent was to avoid taking the subsystem lock for a prolong period as +other processes may need to acquire it (for example new incoming +connections). + +However, it opens up a window where another process may come in and +enable the ns, (re)intiailizing the ns percpu_ref, causing the disable +sequence to hang. + +Solve this by taking the global nvmet_config_sem over the entire configfs +enable/disable sequence. + +Fixes: a07b4970f464 ("nvmet: add a generic NVMe target") +Signed-off-by: Sagi Grimberg +Reviewed-by: Christoph Hellwig +Reviewed-by: Chaitanya Kulkarni +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/configfs.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/nvme/target/configfs.c b/drivers/nvme/target/configfs.c +index b37a8e3e3f800..921efb20f6d7b 100644 +--- a/drivers/nvme/target/configfs.c ++++ b/drivers/nvme/target/configfs.c +@@ -464,10 +464,18 @@ static ssize_t nvmet_ns_enable_store(struct config_item *item, + if (strtobool(page, &enable)) + return -EINVAL; + ++ /* ++ * take a global nvmet_config_sem because the disable routine has a ++ * window where it releases the subsys-lock, giving a chance to ++ * a parallel enable to concurrently execute causing the disable to ++ * have a misaccounting of the ns percpu_ref. ++ */ ++ down_write(&nvmet_config_sem); + if (enable) + ret = nvmet_ns_enable(ns); + else + nvmet_ns_disable(ns); ++ up_write(&nvmet_config_sem); + + return ret ? ret : count; + } +-- +2.43.0 + diff --git a/queue-4.19/series b/queue-4.19/series index ec9d4b1cdaf..abdf0886922 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -131,3 +131,15 @@ net-fec-avoid-lock-evasion-when-reading-pps_enable.patch tcp-remove-64-kbyte-limit-for-initial-tp-rcv_wnd-val.patch nfc-nci-fix-kcov-check-in-nci_rx_work.patch nfc-nci-fix-handling-of-zero-length-payload-packets-.patch +netfilter-nfnetlink_queue-acquire-rcu_read_lock-in-i.patch +spi-don-t-mark-message-dma-mapped-when-no-transfer-i.patch +nvmet-fix-ns-enable-disable-possible-hang.patch +net-mlx5e-use-rx_missed_errors-instead-of-rx_dropped.patch +dma-buf-sw-sync-don-t-enable-irq-from-sync_print_obj.patch +enic-validate-length-of-nl-attributes-in-enic_set_vf.patch +smsc95xx-remove-redundant-function-arguments.patch +smsc95xx-use-usbnet-driver_priv.patch +net-usb-smsc95xx-fix-changing-led_sel-bit-value-upda.patch +net-fec-add-fec_enet_deinit.patch +kconfig-fix-comparison-to-constant-symbols-m-n.patch +ipvlan-dont-use-skb-sk-in-ipvlan_process_v-4-6-_outb.patch diff --git a/queue-4.19/smsc95xx-remove-redundant-function-arguments.patch b/queue-4.19/smsc95xx-remove-redundant-function-arguments.patch new file mode 100644 index 00000000000..23b47909167 --- /dev/null +++ b/queue-4.19/smsc95xx-remove-redundant-function-arguments.patch @@ -0,0 +1,128 @@ +From 914f00f6d311e289eeede53410c18f21c5aedd46 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Aug 2020 13:17:15 +0200 +Subject: smsc95xx: remove redundant function arguments + +From: Andre Edich + +[ Upstream commit 368be1ca28f66deba16627e2a02e78adedd023a6 ] + +This patch removes arguments netdev and phy_id from the functions +smsc95xx_mdio_read_nopm and smsc95xx_mdio_write_nopm. Both removed +arguments are recovered from a new argument `struct usbnet *dev`. + +Signed-off-by: Andre Edich +Signed-off-by: David S. Miller +Stable-dep-of: 52a2f0608366 ("net: usb: smsc95xx: fix changing LED_SEL bit value updated from EEPROM") +Signed-off-by: Sasha Levin +--- + drivers/net/usb/smsc95xx.c | 35 +++++++++++++++++------------------ + 1 file changed, 17 insertions(+), 18 deletions(-) + +diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c +index be5543c71d069..de45a6209c2e6 100644 +--- a/drivers/net/usb/smsc95xx.c ++++ b/drivers/net/usb/smsc95xx.c +@@ -273,16 +273,18 @@ static void __smsc95xx_mdio_write(struct net_device *netdev, int phy_id, + mutex_unlock(&dev->phy_mutex); + } + +-static int smsc95xx_mdio_read_nopm(struct net_device *netdev, int phy_id, +- int idx) ++static int smsc95xx_mdio_read_nopm(struct usbnet *dev, int idx) + { +- return __smsc95xx_mdio_read(netdev, phy_id, idx, 1); ++ struct mii_if_info *mii = &dev->mii; ++ ++ return __smsc95xx_mdio_read(dev->net, mii->phy_id, idx, 1); + } + +-static void smsc95xx_mdio_write_nopm(struct net_device *netdev, int phy_id, +- int idx, int regval) ++static void smsc95xx_mdio_write_nopm(struct usbnet *dev, int idx, int regval) + { +- __smsc95xx_mdio_write(netdev, phy_id, idx, regval, 1); ++ struct mii_if_info *mii = &dev->mii; ++ ++ __smsc95xx_mdio_write(dev->net, mii->phy_id, idx, regval, 1); + } + + static int smsc95xx_mdio_read(struct net_device *netdev, int phy_id, int idx) +@@ -1361,39 +1363,37 @@ static u32 smsc_crc(const u8 *buffer, size_t len, int filter) + + static int smsc95xx_enable_phy_wakeup_interrupts(struct usbnet *dev, u16 mask) + { +- struct mii_if_info *mii = &dev->mii; + int ret; + + netdev_dbg(dev->net, "enabling PHY wakeup interrupts\n"); + + /* read to clear */ +- ret = smsc95xx_mdio_read_nopm(dev->net, mii->phy_id, PHY_INT_SRC); ++ ret = smsc95xx_mdio_read_nopm(dev, PHY_INT_SRC); + if (ret < 0) + return ret; + + /* enable interrupt source */ +- ret = smsc95xx_mdio_read_nopm(dev->net, mii->phy_id, PHY_INT_MASK); ++ ret = smsc95xx_mdio_read_nopm(dev, PHY_INT_MASK); + if (ret < 0) + return ret; + + ret |= mask; + +- smsc95xx_mdio_write_nopm(dev->net, mii->phy_id, PHY_INT_MASK, ret); ++ smsc95xx_mdio_write_nopm(dev, PHY_INT_MASK, ret); + + return 0; + } + + static int smsc95xx_link_ok_nopm(struct usbnet *dev) + { +- struct mii_if_info *mii = &dev->mii; + int ret; + + /* first, a dummy read, needed to latch some MII phys */ +- ret = smsc95xx_mdio_read_nopm(dev->net, mii->phy_id, MII_BMSR); ++ ret = smsc95xx_mdio_read_nopm(dev, MII_BMSR); + if (ret < 0) + return ret; + +- ret = smsc95xx_mdio_read_nopm(dev->net, mii->phy_id, MII_BMSR); ++ ret = smsc95xx_mdio_read_nopm(dev, MII_BMSR); + if (ret < 0) + return ret; + +@@ -1442,7 +1442,6 @@ static int smsc95xx_enter_suspend0(struct usbnet *dev) + static int smsc95xx_enter_suspend1(struct usbnet *dev) + { + struct smsc95xx_priv *pdata = (struct smsc95xx_priv *)(dev->data[0]); +- struct mii_if_info *mii = &dev->mii; + u32 val; + int ret; + +@@ -1450,17 +1449,17 @@ static int smsc95xx_enter_suspend1(struct usbnet *dev) + * compatibility with non-standard link partners + */ + if (pdata->features & FEATURE_PHY_NLP_CROSSOVER) +- smsc95xx_mdio_write_nopm(dev->net, mii->phy_id, PHY_EDPD_CONFIG, +- PHY_EDPD_CONFIG_DEFAULT); ++ smsc95xx_mdio_write_nopm(dev, PHY_EDPD_CONFIG, ++ PHY_EDPD_CONFIG_DEFAULT); + + /* enable energy detect power-down mode */ +- ret = smsc95xx_mdio_read_nopm(dev->net, mii->phy_id, PHY_MODE_CTRL_STS); ++ ret = smsc95xx_mdio_read_nopm(dev, PHY_MODE_CTRL_STS); + if (ret < 0) + return ret; + + ret |= MODE_CTRL_STS_EDPWRDOWN_; + +- smsc95xx_mdio_write_nopm(dev->net, mii->phy_id, PHY_MODE_CTRL_STS, ret); ++ smsc95xx_mdio_write_nopm(dev, PHY_MODE_CTRL_STS, ret); + + /* enter SUSPEND1 mode */ + ret = smsc95xx_read_reg_nopm(dev, PM_CTRL, &val); +-- +2.43.0 + diff --git a/queue-4.19/smsc95xx-use-usbnet-driver_priv.patch b/queue-4.19/smsc95xx-use-usbnet-driver_priv.patch new file mode 100644 index 00000000000..c6ebeb78f23 --- /dev/null +++ b/queue-4.19/smsc95xx-use-usbnet-driver_priv.patch @@ -0,0 +1,246 @@ +From eddda7f9b5dda39c0089252c1a401c1597e5586a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Aug 2020 13:17:16 +0200 +Subject: smsc95xx: use usbnet->driver_priv + +From: Andre Edich + +[ Upstream commit ad90a73f0236c41f7a2dedc2e75c7b5a364eb93e ] + +Using `void *driver_priv` instead of `unsigned long data[]` is more +straightforward way to recover the `struct smsc95xx_priv *` from the +`struct net_device *`. + +Signed-off-by: Andre Edich +Signed-off-by: David S. Miller +Stable-dep-of: 52a2f0608366 ("net: usb: smsc95xx: fix changing LED_SEL bit value updated from EEPROM") +Signed-off-by: Sasha Levin +--- + drivers/net/usb/smsc95xx.c | 61 +++++++++++++++++--------------------- + 1 file changed, 28 insertions(+), 33 deletions(-) + +diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c +index de45a6209c2e6..ec233d033f5cd 100644 +--- a/drivers/net/usb/smsc95xx.c ++++ b/drivers/net/usb/smsc95xx.c +@@ -469,7 +469,7 @@ static unsigned int smsc95xx_hash(char addr[ETH_ALEN]) + static void smsc95xx_set_multicast(struct net_device *netdev) + { + struct usbnet *dev = netdev_priv(netdev); +- struct smsc95xx_priv *pdata = (struct smsc95xx_priv *)(dev->data[0]); ++ struct smsc95xx_priv *pdata = dev->driver_priv; + unsigned long flags; + int ret; + +@@ -564,7 +564,7 @@ static int smsc95xx_phy_update_flowcontrol(struct usbnet *dev, u8 duplex, + + static int smsc95xx_link_reset(struct usbnet *dev) + { +- struct smsc95xx_priv *pdata = (struct smsc95xx_priv *)(dev->data[0]); ++ struct smsc95xx_priv *pdata = dev->driver_priv; + struct mii_if_info *mii = &dev->mii; + struct ethtool_cmd ecmd = { .cmd = ETHTOOL_GSET }; + unsigned long flags; +@@ -634,7 +634,7 @@ static void smsc95xx_status(struct usbnet *dev, struct urb *urb) + + static void set_carrier(struct usbnet *dev, bool link) + { +- struct smsc95xx_priv *pdata = (struct smsc95xx_priv *)(dev->data[0]); ++ struct smsc95xx_priv *pdata = dev->driver_priv; + + if (pdata->link_ok == link) + return; +@@ -763,7 +763,7 @@ static void smsc95xx_ethtool_get_wol(struct net_device *net, + struct ethtool_wolinfo *wolinfo) + { + struct usbnet *dev = netdev_priv(net); +- struct smsc95xx_priv *pdata = (struct smsc95xx_priv *)(dev->data[0]); ++ struct smsc95xx_priv *pdata = dev->driver_priv; + + wolinfo->supported = SUPPORTED_WAKE; + wolinfo->wolopts = pdata->wolopts; +@@ -773,7 +773,7 @@ static int smsc95xx_ethtool_set_wol(struct net_device *net, + struct ethtool_wolinfo *wolinfo) + { + struct usbnet *dev = netdev_priv(net); +- struct smsc95xx_priv *pdata = (struct smsc95xx_priv *)(dev->data[0]); ++ struct smsc95xx_priv *pdata = dev->driver_priv; + int ret; + + if (wolinfo->wolopts & ~SUPPORTED_WAKE) +@@ -812,7 +812,7 @@ static int get_mdix_status(struct net_device *net) + static void set_mdix_status(struct net_device *net, __u8 mdix_ctrl) + { + struct usbnet *dev = netdev_priv(net); +- struct smsc95xx_priv *pdata = (struct smsc95xx_priv *)(dev->data[0]); ++ struct smsc95xx_priv *pdata = dev->driver_priv; + int buf; + + if ((pdata->chip_id == ID_REV_CHIP_ID_9500A_) || +@@ -861,7 +861,7 @@ static int smsc95xx_get_link_ksettings(struct net_device *net, + struct ethtool_link_ksettings *cmd) + { + struct usbnet *dev = netdev_priv(net); +- struct smsc95xx_priv *pdata = (struct smsc95xx_priv *)(dev->data[0]); ++ struct smsc95xx_priv *pdata = dev->driver_priv; + int retval; + + retval = usbnet_get_link_ksettings(net, cmd); +@@ -876,7 +876,7 @@ static int smsc95xx_set_link_ksettings(struct net_device *net, + const struct ethtool_link_ksettings *cmd) + { + struct usbnet *dev = netdev_priv(net); +- struct smsc95xx_priv *pdata = (struct smsc95xx_priv *)(dev->data[0]); ++ struct smsc95xx_priv *pdata = dev->driver_priv; + int retval; + + if (pdata->mdix_ctrl != cmd->base.eth_tp_mdix_ctrl) +@@ -958,7 +958,7 @@ static int smsc95xx_set_mac_address(struct usbnet *dev) + /* starts the TX path */ + static int smsc95xx_start_tx_path(struct usbnet *dev) + { +- struct smsc95xx_priv *pdata = (struct smsc95xx_priv *)(dev->data[0]); ++ struct smsc95xx_priv *pdata = dev->driver_priv; + unsigned long flags; + int ret; + +@@ -978,7 +978,7 @@ static int smsc95xx_start_tx_path(struct usbnet *dev) + /* Starts the Receive path */ + static int smsc95xx_start_rx_path(struct usbnet *dev, int in_pm) + { +- struct smsc95xx_priv *pdata = (struct smsc95xx_priv *)(dev->data[0]); ++ struct smsc95xx_priv *pdata = dev->driver_priv; + unsigned long flags; + + spin_lock_irqsave(&pdata->mac_cr_lock, flags); +@@ -1035,7 +1035,7 @@ static int smsc95xx_phy_initialize(struct usbnet *dev) + + static int smsc95xx_reset(struct usbnet *dev) + { +- struct smsc95xx_priv *pdata = (struct smsc95xx_priv *)(dev->data[0]); ++ struct smsc95xx_priv *pdata = dev->driver_priv; + u32 read_buf, write_buf, burst_cap; + int ret = 0, timeout; + +@@ -1263,7 +1263,7 @@ static const struct net_device_ops smsc95xx_netdev_ops = { + + static int smsc95xx_bind(struct usbnet *dev, struct usb_interface *intf) + { +- struct smsc95xx_priv *pdata = NULL; ++ struct smsc95xx_priv *pdata; + u32 val; + int ret; + +@@ -1275,13 +1275,12 @@ static int smsc95xx_bind(struct usbnet *dev, struct usb_interface *intf) + return ret; + } + +- dev->data[0] = (unsigned long)kzalloc(sizeof(struct smsc95xx_priv), +- GFP_KERNEL); +- +- pdata = (struct smsc95xx_priv *)(dev->data[0]); ++ pdata = kzalloc(sizeof(*pdata), GFP_KERNEL); + if (!pdata) + return -ENOMEM; + ++ dev->driver_priv = pdata; ++ + spin_lock_init(&pdata->mac_cr_lock); + + /* LAN95xx devices do not alter the computed checksum of 0 to 0xffff. +@@ -1344,15 +1343,11 @@ static int smsc95xx_bind(struct usbnet *dev, struct usb_interface *intf) + + static void smsc95xx_unbind(struct usbnet *dev, struct usb_interface *intf) + { +- struct smsc95xx_priv *pdata = (struct smsc95xx_priv *)(dev->data[0]); +- +- if (pdata) { +- cancel_delayed_work_sync(&pdata->carrier_check); +- netif_dbg(dev, ifdown, dev->net, "free pdata\n"); +- kfree(pdata); +- pdata = NULL; +- dev->data[0] = 0; +- } ++ struct smsc95xx_priv *pdata = dev->driver_priv; ++ ++ cancel_delayed_work_sync(&pdata->carrier_check); ++ netif_dbg(dev, ifdown, dev->net, "free pdata\n"); ++ kfree(pdata); + } + + static u32 smsc_crc(const u8 *buffer, size_t len, int filter) +@@ -1402,7 +1397,7 @@ static int smsc95xx_link_ok_nopm(struct usbnet *dev) + + static int smsc95xx_enter_suspend0(struct usbnet *dev) + { +- struct smsc95xx_priv *pdata = (struct smsc95xx_priv *)(dev->data[0]); ++ struct smsc95xx_priv *pdata = dev->driver_priv; + u32 val; + int ret; + +@@ -1441,7 +1436,7 @@ static int smsc95xx_enter_suspend0(struct usbnet *dev) + + static int smsc95xx_enter_suspend1(struct usbnet *dev) + { +- struct smsc95xx_priv *pdata = (struct smsc95xx_priv *)(dev->data[0]); ++ struct smsc95xx_priv *pdata = dev->driver_priv; + u32 val; + int ret; + +@@ -1488,7 +1483,7 @@ static int smsc95xx_enter_suspend1(struct usbnet *dev) + + static int smsc95xx_enter_suspend2(struct usbnet *dev) + { +- struct smsc95xx_priv *pdata = (struct smsc95xx_priv *)(dev->data[0]); ++ struct smsc95xx_priv *pdata = dev->driver_priv; + u32 val; + int ret; + +@@ -1510,7 +1505,7 @@ static int smsc95xx_enter_suspend2(struct usbnet *dev) + + static int smsc95xx_enter_suspend3(struct usbnet *dev) + { +- struct smsc95xx_priv *pdata = (struct smsc95xx_priv *)(dev->data[0]); ++ struct smsc95xx_priv *pdata = dev->driver_priv; + u32 val; + int ret; + +@@ -1549,7 +1544,7 @@ static int smsc95xx_enter_suspend3(struct usbnet *dev) + + static int smsc95xx_autosuspend(struct usbnet *dev, u32 link_up) + { +- struct smsc95xx_priv *pdata = (struct smsc95xx_priv *)(dev->data[0]); ++ struct smsc95xx_priv *pdata = dev->driver_priv; + int ret; + + if (!netif_running(dev->net)) { +@@ -1597,7 +1592,7 @@ static int smsc95xx_autosuspend(struct usbnet *dev, u32 link_up) + static int smsc95xx_suspend(struct usb_interface *intf, pm_message_t message) + { + struct usbnet *dev = usb_get_intfdata(intf); +- struct smsc95xx_priv *pdata = (struct smsc95xx_priv *)(dev->data[0]); ++ struct smsc95xx_priv *pdata = dev->driver_priv; + u32 val, link_up; + int ret; + +@@ -1868,7 +1863,7 @@ static int smsc95xx_resume(struct usb_interface *intf) + u32 val; + + BUG_ON(!dev); +- pdata = (struct smsc95xx_priv *)(dev->data[0]); ++ pdata = dev->driver_priv; + suspend_flags = pdata->suspend_flags; + + netdev_dbg(dev->net, "resume suspend_flags=0x%02x\n", suspend_flags); +@@ -2079,7 +2074,7 @@ static struct sk_buff *smsc95xx_tx_fixup(struct usbnet *dev, + + static int smsc95xx_manage_power(struct usbnet *dev, int on) + { +- struct smsc95xx_priv *pdata = (struct smsc95xx_priv *)(dev->data[0]); ++ struct smsc95xx_priv *pdata = dev->driver_priv; + + dev->intf->needs_remote_wakeup = on; + +-- +2.43.0 + diff --git a/queue-4.19/spi-don-t-mark-message-dma-mapped-when-no-transfer-i.patch b/queue-4.19/spi-don-t-mark-message-dma-mapped-when-no-transfer-i.patch new file mode 100644 index 00000000000..95bf83935e4 --- /dev/null +++ b/queue-4.19/spi-don-t-mark-message-dma-mapped-when-no-transfer-i.patch @@ -0,0 +1,48 @@ +From 6f1a66bf0a567123d1d8dcf2f9d22d31c31bc29d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 May 2024 20:09:49 +0300 +Subject: spi: Don't mark message DMA mapped when no transfer in it is + +From: Andy Shevchenko + +[ Upstream commit 9f788ba457b45b0ce422943fcec9fa35c4587764 ] + +There is no need to set the DMA mapped flag of the message if it has +no mapped transfers. Moreover, it may give the code a chance to take +the wrong paths, i.e. to exercise DMA related APIs on unmapped data. +Make __spi_map_msg() to bail earlier on the above mentioned cases. + +Fixes: 99adef310f68 ("spi: Provide core support for DMA mapping transfers") +Signed-off-by: Andy Shevchenko +Link: https://msgid.link/r/20240522171018.3362521-2-andriy.shevchenko@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c +index 3bcd6f178f73b..a15545cee4d2e 100644 +--- a/drivers/spi/spi.c ++++ b/drivers/spi/spi.c +@@ -866,6 +866,7 @@ static int __spi_map_msg(struct spi_controller *ctlr, struct spi_message *msg) + else + rx_dev = ctlr->dev.parent; + ++ ret = -ENOMSG; + list_for_each_entry(xfer, &msg->transfers, transfer_list) { + if (!ctlr->can_dma(ctlr, msg->spi, xfer)) + continue; +@@ -889,6 +890,9 @@ static int __spi_map_msg(struct spi_controller *ctlr, struct spi_message *msg) + } + } + } ++ /* No transfer has been mapped, bail out with success */ ++ if (ret) ++ return 0; + + ctlr->cur_msg_mapped = true; + +-- +2.43.0 +