From: Greg Kroah-Hartman Date: Fri, 12 Mar 2021 13:04:44 +0000 (+0100) Subject: 5.4-stable patches X-Git-Tag: v4.4.262~96 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=12633e61b01823150e3c11a05789ff1ba1ec9035;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: bnxt_en-reliably-allocate-irq-table-on-reset-to-avoid-crash.patch cipso-calipso-resolve-a-number-of-problems-with-the-doi-refcounts.patch ixgbe-fail-to-create-xfrm-offload-of-ipsec-tunnel-mode-sa.patch net-bonding-fix-error-return-code-of-bond_neigh_init.patch net-davicom-fix-regulator-not-turned-off-on-driver-removal.patch net-davicom-fix-regulator-not-turned-off-on-failed-probe.patch net-hns3-fix-bug-when-calculating-the-tcam-table-info.patch net-hns3-fix-query-vlan-mask-value-error-for-flow-director.patch net-lapbether-remove-netif_start_queue-netif_stop_queue.patch net-qrtr-fix-error-return-code-of-qrtr_sendmsg.patch net-sched-avoid-duplicates-in-classes-dump.patch net-stmmac-fix-watchdog-timeout-during-suspend-resume-stress-test.patch net-stmmac-stop-each-tx-channel-independently.patch net-usb-qmi_wwan-allow-qmimux-add-del-with-master-up.patch netdevsim-init-u64-stats-for-32bit-hardware.patch perf-traceevent-ensure-read-cmdlines-are-null-terminated.patch s390-cio-return-efault-if-copy_to_user-fails.patch selftests-forwarding-fix-race-condition-in-mirror-installation.patch --- diff --git a/queue-5.4/bnxt_en-reliably-allocate-irq-table-on-reset-to-avoid-crash.patch b/queue-5.4/bnxt_en-reliably-allocate-irq-table-on-reset-to-avoid-crash.patch new file mode 100644 index 00000000000..68a168f10a4 --- /dev/null +++ b/queue-5.4/bnxt_en-reliably-allocate-irq-table-on-reset-to-avoid-crash.patch @@ -0,0 +1,127 @@ +From 20d7d1c5c9b11e9f538ed4a2289be106de970d3e Mon Sep 17 00:00:00 2001 +From: Edwin Peer +Date: Fri, 26 Feb 2021 04:43:10 -0500 +Subject: bnxt_en: reliably allocate IRQ table on reset to avoid crash + +From: Edwin Peer + +commit 20d7d1c5c9b11e9f538ed4a2289be106de970d3e upstream. + +The following trace excerpt corresponds with a NULL pointer dereference +of 'bp->irq_tbl' in bnxt_setup_inta() on an Aarch64 system after many +device resets: + + Unable to handle kernel NULL pointer dereference at ... 000000d + ... + pc : string+0x3c/0x80 + lr : vsnprintf+0x294/0x7e0 + sp : ffff00000f61ba70 pstate : 20000145 + x29: ffff00000f61ba70 x28: 000000000000000d + x27: ffff0000009c8b5a x26: ffff00000f61bb80 + x25: ffff0000009c8b5a x24: 0000000000000012 + x23: 00000000ffffffe0 x22: ffff000008990428 + x21: ffff00000f61bb80 x20: 000000000000000d + x19: 000000000000001f x18: 0000000000000000 + x17: 0000000000000000 x16: ffff800b6d0fb400 + x15: 0000000000000000 x14: ffff800b7fe31ae8 + x13: 00001ed16472c920 x12: ffff000008c6b1c9 + x11: ffff000008cf0580 x10: ffff00000f61bb80 + x9 : 00000000ffffffd8 x8 : 000000000000000c + x7 : ffff800b684b8000 x6 : 0000000000000000 + x5 : 0000000000000065 x4 : 0000000000000001 + x3 : ffff0a00ffffff04 x2 : 000000000000001f + x1 : 0000000000000000 x0 : 000000000000000d + Call trace: + string+0x3c/0x80 + vsnprintf+0x294/0x7e0 + snprintf+0x44/0x50 + __bnxt_open_nic+0x34c/0x928 [bnxt_en] + bnxt_open+0xe8/0x238 [bnxt_en] + __dev_open+0xbc/0x130 + __dev_change_flags+0x12c/0x168 + dev_change_flags+0x20/0x60 + ... + +Ordinarily, a call to bnxt_setup_inta() (not in trace due to inlining) +would not be expected on a system supporting MSIX at all. However, if +bnxt_init_int_mode() does not end up being called after the call to +bnxt_clear_int_mode() in bnxt_fw_reset_close(), then the driver will +think that only INTA is supported and bp->irq_tbl will be NULL, +causing the above crash. + +In the error recovery scenario, we call bnxt_clear_int_mode() in +bnxt_fw_reset_close() early in the sequence. Ordinarily, we will +call bnxt_init_int_mode() in bnxt_hwrm_if_change() after we +reestablish communication with the firmware after reset. However, +if the sequence has to abort before we call bnxt_init_int_mode() and +if the user later attempts to re-open the device, then it will cause +the crash above. + +We fix it in 2 ways: + +1. Check for bp->irq_tbl in bnxt_setup_int_mode(). If it is NULL, call +bnxt_init_init_mode(). + +2. If we need to abort in bnxt_hwrm_if_change() and cannot complete +the error recovery sequence, set the BNXT_STATE_ABORT_ERR flag. This +will cause more drastic recovery at the next attempt to re-open the +device, including a call to bnxt_init_int_mode(). + +Fixes: 3bc7d4a352ef ("bnxt_en: Add BNXT_STATE_IN_FW_RESET state.") +Reviewed-by: Scott Branden +Signed-off-by: Edwin Peer +Signed-off-by: Michael Chan +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -7925,10 +7925,18 @@ static void bnxt_setup_inta(struct bnxt + bp->irq_tbl[0].handler = bnxt_inta; + } + ++static int bnxt_init_int_mode(struct bnxt *bp); ++ + static int bnxt_setup_int_mode(struct bnxt *bp) + { + int rc; + ++ if (!bp->irq_tbl) { ++ rc = bnxt_init_int_mode(bp); ++ if (rc || !bp->irq_tbl) ++ return rc ?: -ENODEV; ++ } ++ + if (bp->flags & BNXT_FLAG_USING_MSIX) + bnxt_setup_msix(bp); + else +@@ -8113,7 +8121,7 @@ static int bnxt_init_inta(struct bnxt *b + + static int bnxt_init_int_mode(struct bnxt *bp) + { +- int rc = 0; ++ int rc = -ENODEV; + + if (bp->flags & BNXT_FLAG_MSIX_CAP) + rc = bnxt_init_msix(bp); +@@ -8748,7 +8756,8 @@ static int bnxt_hwrm_if_change(struct bn + { + struct hwrm_func_drv_if_change_output *resp = bp->hwrm_cmd_resp_addr; + struct hwrm_func_drv_if_change_input req = {0}; +- bool resc_reinit = false, fw_reset = false; ++ bool fw_reset = !bp->irq_tbl; ++ bool resc_reinit = false; + u32 flags = 0; + int rc; + +@@ -8776,6 +8785,7 @@ static int bnxt_hwrm_if_change(struct bn + + if (test_bit(BNXT_STATE_IN_FW_RESET, &bp->state) && !fw_reset) { + netdev_err(bp->dev, "RESET_DONE not set during FW reset.\n"); ++ set_bit(BNXT_STATE_ABORT_ERR, &bp->state); + return -ENODEV; + } + if (resc_reinit || fw_reset) { diff --git a/queue-5.4/cipso-calipso-resolve-a-number-of-problems-with-the-doi-refcounts.patch b/queue-5.4/cipso-calipso-resolve-a-number-of-problems-with-the-doi-refcounts.patch new file mode 100644 index 00000000000..ca71479c7bc --- /dev/null +++ b/queue-5.4/cipso-calipso-resolve-a-number-of-problems-with-the-doi-refcounts.patch @@ -0,0 +1,134 @@ +From ad5d07f4a9cd671233ae20983848874731102c08 Mon Sep 17 00:00:00 2001 +From: Paul Moore +Date: Thu, 4 Mar 2021 16:29:51 -0500 +Subject: cipso,calipso: resolve a number of problems with the DOI refcounts + +From: Paul Moore + +commit ad5d07f4a9cd671233ae20983848874731102c08 upstream. + +The current CIPSO and CALIPSO refcounting scheme for the DOI +definitions is a bit flawed in that we: + +1. Don't correctly match gets/puts in netlbl_cipsov4_list(). +2. Decrement the refcount on each attempt to remove the DOI from the + DOI list, only removing it from the list once the refcount drops + to zero. + +This patch fixes these problems by adding the missing "puts" to +netlbl_cipsov4_list() and introduces a more conventional, i.e. +not-buggy, refcounting mechanism to the DOI definitions. Upon the +addition of a DOI to the DOI list, it is initialized with a refcount +of one, removing a DOI from the list removes it from the list and +drops the refcount by one; "gets" and "puts" behave as expected with +respect to refcounts, increasing and decreasing the DOI's refcount by +one. + +Fixes: b1edeb102397 ("netlabel: Replace protocol/NetLabel linking with refrerence counts") +Fixes: d7cce01504a0 ("netlabel: Add support for removing a CALIPSO DOI.") +Reported-by: syzbot+9ec037722d2603a9f52e@syzkaller.appspotmail.com +Signed-off-by: Paul Moore +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/cipso_ipv4.c | 11 +---------- + net/ipv6/calipso.c | 14 +++++--------- + net/netlabel/netlabel_cipso_v4.c | 3 +++ + 3 files changed, 9 insertions(+), 19 deletions(-) + +--- a/net/ipv4/cipso_ipv4.c ++++ b/net/ipv4/cipso_ipv4.c +@@ -519,16 +519,10 @@ int cipso_v4_doi_remove(u32 doi, struct + ret_val = -ENOENT; + goto doi_remove_return; + } +- if (!refcount_dec_and_test(&doi_def->refcount)) { +- spin_unlock(&cipso_v4_doi_list_lock); +- ret_val = -EBUSY; +- goto doi_remove_return; +- } + list_del_rcu(&doi_def->list); + spin_unlock(&cipso_v4_doi_list_lock); + +- cipso_v4_cache_invalidate(); +- call_rcu(&doi_def->rcu, cipso_v4_doi_free_rcu); ++ cipso_v4_doi_putdef(doi_def); + ret_val = 0; + + doi_remove_return: +@@ -585,9 +579,6 @@ void cipso_v4_doi_putdef(struct cipso_v4 + + if (!refcount_dec_and_test(&doi_def->refcount)) + return; +- spin_lock(&cipso_v4_doi_list_lock); +- list_del_rcu(&doi_def->list); +- spin_unlock(&cipso_v4_doi_list_lock); + + cipso_v4_cache_invalidate(); + call_rcu(&doi_def->rcu, cipso_v4_doi_free_rcu); +--- a/net/ipv6/calipso.c ++++ b/net/ipv6/calipso.c +@@ -83,6 +83,9 @@ struct calipso_map_cache_entry { + + static struct calipso_map_cache_bkt *calipso_cache; + ++static void calipso_cache_invalidate(void); ++static void calipso_doi_putdef(struct calipso_doi *doi_def); ++ + /* Label Mapping Cache Functions + */ + +@@ -444,15 +447,10 @@ static int calipso_doi_remove(u32 doi, s + ret_val = -ENOENT; + goto doi_remove_return; + } +- if (!refcount_dec_and_test(&doi_def->refcount)) { +- spin_unlock(&calipso_doi_list_lock); +- ret_val = -EBUSY; +- goto doi_remove_return; +- } + list_del_rcu(&doi_def->list); + spin_unlock(&calipso_doi_list_lock); + +- call_rcu(&doi_def->rcu, calipso_doi_free_rcu); ++ calipso_doi_putdef(doi_def); + ret_val = 0; + + doi_remove_return: +@@ -508,10 +506,8 @@ static void calipso_doi_putdef(struct ca + + if (!refcount_dec_and_test(&doi_def->refcount)) + return; +- spin_lock(&calipso_doi_list_lock); +- list_del_rcu(&doi_def->list); +- spin_unlock(&calipso_doi_list_lock); + ++ calipso_cache_invalidate(); + call_rcu(&doi_def->rcu, calipso_doi_free_rcu); + } + +--- a/net/netlabel/netlabel_cipso_v4.c ++++ b/net/netlabel/netlabel_cipso_v4.c +@@ -575,6 +575,7 @@ list_start: + + break; + } ++ cipso_v4_doi_putdef(doi_def); + rcu_read_unlock(); + + genlmsg_end(ans_skb, data); +@@ -583,12 +584,14 @@ list_start: + list_retry: + /* XXX - this limit is a guesstimate */ + if (nlsze_mult < 4) { ++ cipso_v4_doi_putdef(doi_def); + rcu_read_unlock(); + kfree_skb(ans_skb); + nlsze_mult *= 2; + goto list_start; + } + list_failure_lock: ++ cipso_v4_doi_putdef(doi_def); + rcu_read_unlock(); + list_failure: + kfree_skb(ans_skb); diff --git a/queue-5.4/ixgbe-fail-to-create-xfrm-offload-of-ipsec-tunnel-mode-sa.patch b/queue-5.4/ixgbe-fail-to-create-xfrm-offload-of-ipsec-tunnel-mode-sa.patch new file mode 100644 index 00000000000..a748b66f4e7 --- /dev/null +++ b/queue-5.4/ixgbe-fail-to-create-xfrm-offload-of-ipsec-tunnel-mode-sa.patch @@ -0,0 +1,53 @@ +From d785e1fec60179f534fbe8d006c890e5ad186e51 Mon Sep 17 00:00:00 2001 +From: Antony Antony +Date: Wed, 14 Oct 2020 16:17:48 +0200 +Subject: ixgbe: fail to create xfrm offload of IPsec tunnel mode SA + +From: Antony Antony + +commit d785e1fec60179f534fbe8d006c890e5ad186e51 upstream. + +Based on talks and indirect references ixgbe IPsec offlod do not +support IPsec tunnel mode offload. It can only support IPsec transport +mode offload. Now explicitly fail when creating non transport mode SA +with offload to avoid false performance expectations. + +Fixes: 63a67fe229ea ("ixgbe: add ipsec offload add and remove SA") +Signed-off-by: Antony Antony +Acked-by: Shannon Nelson +Tested-by: Tony Brelinski +Signed-off-by: Tony Nguyen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c | 5 +++++ + drivers/net/ethernet/intel/ixgbevf/ipsec.c | 5 +++++ + 2 files changed, 10 insertions(+) + +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c +@@ -575,6 +575,11 @@ static int ixgbe_ipsec_add_sa(struct xfr + return -EINVAL; + } + ++ if (xs->props.mode != XFRM_MODE_TRANSPORT) { ++ netdev_err(dev, "Unsupported mode for ipsec offload\n"); ++ return -EINVAL; ++ } ++ + if (ixgbe_ipsec_check_mgmt_ip(xs)) { + netdev_err(dev, "IPsec IP addr clash with mgmt filters\n"); + return -EINVAL; +--- a/drivers/net/ethernet/intel/ixgbevf/ipsec.c ++++ b/drivers/net/ethernet/intel/ixgbevf/ipsec.c +@@ -272,6 +272,11 @@ static int ixgbevf_ipsec_add_sa(struct x + return -EINVAL; + } + ++ if (xs->props.mode != XFRM_MODE_TRANSPORT) { ++ netdev_err(dev, "Unsupported mode for ipsec offload\n"); ++ return -EINVAL; ++ } ++ + if (xs->xso.flags & XFRM_OFFLOAD_INBOUND) { + struct rx_sa rsa; + diff --git a/queue-5.4/net-bonding-fix-error-return-code-of-bond_neigh_init.patch b/queue-5.4/net-bonding-fix-error-return-code-of-bond_neigh_init.patch new file mode 100644 index 00000000000..7e4503554b1 --- /dev/null +++ b/queue-5.4/net-bonding-fix-error-return-code-of-bond_neigh_init.patch @@ -0,0 +1,42 @@ +From 2055a99da8a253a357bdfd359b3338ef3375a26c Mon Sep 17 00:00:00 2001 +From: Jia-Ju Bai +Date: Sun, 7 Mar 2021 19:11:02 -0800 +Subject: net: bonding: fix error return code of bond_neigh_init() + +From: Jia-Ju Bai + +commit 2055a99da8a253a357bdfd359b3338ef3375a26c upstream. + +When slave is NULL or slave_ops->ndo_neigh_setup is NULL, no error +return code of bond_neigh_init() is assigned. +To fix this bug, ret is assigned with -EINVAL in these cases. + +Fixes: 9e99bfefdbce ("bonding: fix bond_neigh_init()") +Reported-by: TOTE Robot +Signed-off-by: Jia-Ju Bai +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/bonding/bond_main.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -3703,11 +3703,15 @@ static int bond_neigh_init(struct neighb + + rcu_read_lock(); + slave = bond_first_slave_rcu(bond); +- if (!slave) ++ if (!slave) { ++ ret = -EINVAL; + goto out; ++ } + slave_ops = slave->dev->netdev_ops; +- if (!slave_ops->ndo_neigh_setup) ++ if (!slave_ops->ndo_neigh_setup) { ++ ret = -EINVAL; + goto out; ++ } + + /* TODO: find another way [1] to implement this. + * Passing a zeroed structure is fragile, diff --git a/queue-5.4/net-davicom-fix-regulator-not-turned-off-on-driver-removal.patch b/queue-5.4/net-davicom-fix-regulator-not-turned-off-on-driver-removal.patch new file mode 100644 index 00000000000..237d48777e5 --- /dev/null +++ b/queue-5.4/net-davicom-fix-regulator-not-turned-off-on-driver-removal.patch @@ -0,0 +1,54 @@ +From cf9e60aa69ae6c40d3e3e4c94dd6c8de31674e9b Mon Sep 17 00:00:00 2001 +From: Paul Cercueil +Date: Sun, 7 Mar 2021 13:17:48 +0000 +Subject: net: davicom: Fix regulator not turned off on driver removal + +From: Paul Cercueil + +commit cf9e60aa69ae6c40d3e3e4c94dd6c8de31674e9b upstream. + +We must disable the regulator that was enabled in the probe function. + +Fixes: 7994fe55a4a2 ("dm9000: Add regulator and reset support to dm9000") +Signed-off-by: Paul Cercueil +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/davicom/dm9000.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/davicom/dm9000.c ++++ b/drivers/net/ethernet/davicom/dm9000.c +@@ -134,6 +134,8 @@ struct board_info { + u32 wake_state; + + int ip_summed; ++ ++ struct regulator *power_supply; + }; + + /* debug code */ +@@ -1486,6 +1488,8 @@ dm9000_probe(struct platform_device *pde + + db->dev = &pdev->dev; + db->ndev = ndev; ++ if (!IS_ERR(power)) ++ db->power_supply = power; + + spin_lock_init(&db->lock); + mutex_init(&db->addr_lock); +@@ -1771,10 +1775,13 @@ static int + dm9000_drv_remove(struct platform_device *pdev) + { + struct net_device *ndev = platform_get_drvdata(pdev); ++ struct board_info *dm = to_dm9000_board(ndev); + + unregister_netdev(ndev); +- dm9000_release_board(pdev, netdev_priv(ndev)); ++ dm9000_release_board(pdev, dm); + free_netdev(ndev); /* free device structure */ ++ if (dm->power_supply) ++ regulator_disable(dm->power_supply); + + dev_dbg(&pdev->dev, "released and freed device\n"); + return 0; diff --git a/queue-5.4/net-davicom-fix-regulator-not-turned-off-on-failed-probe.patch b/queue-5.4/net-davicom-fix-regulator-not-turned-off-on-failed-probe.patch new file mode 100644 index 00000000000..a37d5f1b0ea --- /dev/null +++ b/queue-5.4/net-davicom-fix-regulator-not-turned-off-on-failed-probe.patch @@ -0,0 +1,55 @@ +From ac88c531a5b38877eba2365a3f28f0c8b513dc33 Mon Sep 17 00:00:00 2001 +From: Paul Cercueil +Date: Sun, 7 Mar 2021 13:17:47 +0000 +Subject: net: davicom: Fix regulator not turned off on failed probe + +From: Paul Cercueil + +commit ac88c531a5b38877eba2365a3f28f0c8b513dc33 upstream. + +When the probe fails or requests to be defered, we must disable the +regulator that was previously enabled. + +Fixes: 7994fe55a4a2 ("dm9000: Add regulator and reset support to dm9000") +Signed-off-by: Paul Cercueil +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/davicom/dm9000.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +--- a/drivers/net/ethernet/davicom/dm9000.c ++++ b/drivers/net/ethernet/davicom/dm9000.c +@@ -1454,7 +1454,7 @@ dm9000_probe(struct platform_device *pde + if (ret) { + dev_err(dev, "failed to request reset gpio %d: %d\n", + reset_gpios, ret); +- return -ENODEV; ++ goto out_regulator_disable; + } + + /* According to manual PWRST# Low Period Min 1ms */ +@@ -1466,8 +1466,10 @@ dm9000_probe(struct platform_device *pde + + if (!pdata) { + pdata = dm9000_parse_dt(&pdev->dev); +- if (IS_ERR(pdata)) +- return PTR_ERR(pdata); ++ if (IS_ERR(pdata)) { ++ ret = PTR_ERR(pdata); ++ goto out_regulator_disable; ++ } + } + + /* Init network device */ +@@ -1708,6 +1710,10 @@ out: + dm9000_release_board(pdev, db); + free_netdev(ndev); + ++out_regulator_disable: ++ if (!IS_ERR(power)) ++ regulator_disable(power); ++ + return ret; + } + diff --git a/queue-5.4/net-hns3-fix-bug-when-calculating-the-tcam-table-info.patch b/queue-5.4/net-hns3-fix-bug-when-calculating-the-tcam-table-info.patch new file mode 100644 index 00000000000..734765f4615 --- /dev/null +++ b/queue-5.4/net-hns3-fix-bug-when-calculating-the-tcam-table-info.patch @@ -0,0 +1,37 @@ +From b36fc875bcdee56865c444a2cdae17d354a6d5f5 Mon Sep 17 00:00:00 2001 +From: Jian Shen +Date: Sat, 27 Feb 2021 15:24:53 +0800 +Subject: net: hns3: fix bug when calculating the TCAM table info + +From: Jian Shen + +commit b36fc875bcdee56865c444a2cdae17d354a6d5f5 upstream. + +The function hclge_fd_convert_tuple() is used to convert tuples +and tuples mask to TCAM x and y. But it misuses the source mac +as source mac mask when convert INNER_SRC_MAC, which may cause +the flow director rule works unexpectedly. So fix it. + +Fixes: 117328680288 ("net: hns3: Add input key and action config support for flow director") +Signed-off-by: Jian Shen +Signed-off-by: Huazhong Tan +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +@@ -4908,9 +4908,9 @@ static bool hclge_fd_convert_tuple(u32 t + case BIT(INNER_SRC_MAC): + for (i = 0; i < ETH_ALEN; i++) { + calc_x(key_x[ETH_ALEN - 1 - i], rule->tuples.src_mac[i], +- rule->tuples.src_mac[i]); ++ rule->tuples_mask.src_mac[i]); + calc_y(key_y[ETH_ALEN - 1 - i], rule->tuples.src_mac[i], +- rule->tuples.src_mac[i]); ++ rule->tuples_mask.src_mac[i]); + } + + return true; diff --git a/queue-5.4/net-hns3-fix-query-vlan-mask-value-error-for-flow-director.patch b/queue-5.4/net-hns3-fix-query-vlan-mask-value-error-for-flow-director.patch new file mode 100644 index 00000000000..3dde2844ec2 --- /dev/null +++ b/queue-5.4/net-hns3-fix-query-vlan-mask-value-error-for-flow-director.patch @@ -0,0 +1,53 @@ +From c75ec148a316e8cf52274d16b9b422703b96f5ce Mon Sep 17 00:00:00 2001 +From: Jian Shen +Date: Sat, 27 Feb 2021 15:24:52 +0800 +Subject: net: hns3: fix query vlan mask value error for flow director + +From: Jian Shen + +commit c75ec148a316e8cf52274d16b9b422703b96f5ce upstream. + +Currently, the driver returns VLAN_VID_MASK for vlan mask field, +when get flow director rule information for rule doesn't use vlan. +It may cause the vlan mask value display as 0xf000 in this +case, like below: + +estuary:/$ ethtool -u eth1 +50 RX rings available +Total 1 rules + +Filter: 2 +Rule Type: TCP over IPv4 +Src IP addr: 0.0.0.0 mask: 255.255.255.255 +Dest IP addr: 0.0.0.0 mask: 255.255.255.255 +TOS: 0x0 mask: 0xff +Src port: 0 mask: 0xffff +Dest port: 0 mask: 0xffff +VLAN EtherType: 0x0 mask: 0xffff +VLAN: 0x0 mask: 0xf000 +User-defined: 0x1234 mask: 0x0 +Action: Direct to queue 3 + +Fix it by return 0. + +Fixes: 05c2314fe6a8 ("net: hns3: Add support for rule query of flow director") +Signed-off-by: Jian Shen +Signed-off-by: Huazhong Tan +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +@@ -5939,8 +5939,7 @@ static int hclge_get_fd_rule_info(struct + fs->h_ext.vlan_tci = cpu_to_be16(rule->tuples.vlan_tag1); + fs->m_ext.vlan_tci = + rule->unused_tuple & BIT(INNER_VLAN_TAG_FST) ? +- cpu_to_be16(VLAN_VID_MASK) : +- cpu_to_be16(rule->tuples_mask.vlan_tag1); ++ 0 : cpu_to_be16(rule->tuples_mask.vlan_tag1); + } + + if (fs->flow_type & FLOW_MAC_EXT) { diff --git a/queue-5.4/net-lapbether-remove-netif_start_queue-netif_stop_queue.patch b/queue-5.4/net-lapbether-remove-netif_start_queue-netif_stop_queue.patch new file mode 100644 index 00000000000..f2864b7ab63 --- /dev/null +++ b/queue-5.4/net-lapbether-remove-netif_start_queue-netif_stop_queue.patch @@ -0,0 +1,61 @@ +From f7d9d4854519fdf4d45c70a4d953438cd88e7e58 Mon Sep 17 00:00:00 2001 +From: Xie He +Date: Sun, 7 Mar 2021 03:33:07 -0800 +Subject: net: lapbether: Remove netif_start_queue / netif_stop_queue + +From: Xie He + +commit f7d9d4854519fdf4d45c70a4d953438cd88e7e58 upstream. + +For the devices in this driver, the default qdisc is "noqueue", +because their "tx_queue_len" is 0. + +In function "__dev_queue_xmit" in "net/core/dev.c", devices with the +"noqueue" qdisc are specially handled. Packets are transmitted without +being queued after a "dev->flags & IFF_UP" check. However, it's possible +that even if this check succeeds, "ops->ndo_stop" may still have already +been called. This is because in "__dev_close_many", "ops->ndo_stop" is +called before clearing the "IFF_UP" flag. + +If we call "netif_stop_queue" in "ops->ndo_stop", then it's possible in +"__dev_queue_xmit", it sees the "IFF_UP" flag is present, and then it +checks "netif_xmit_stopped" and finds that the queue is already stopped. +In this case, it will complain that: +"Virtual device ... asks to queue packet!" + +To prevent "__dev_queue_xmit" from generating this complaint, we should +not call "netif_stop_queue" in "ops->ndo_stop". + +We also don't need to call "netif_start_queue" in "ops->ndo_open", +because after a netdev is allocated and registered, the +"__QUEUE_STATE_DRV_XOFF" flag is initially not set, so there is no need +to call "netif_start_queue" to clear it. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Xie He +Acked-by: Martin Schiller +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wan/lapbether.c | 3 --- + 1 file changed, 3 deletions(-) + +--- a/drivers/net/wan/lapbether.c ++++ b/drivers/net/wan/lapbether.c +@@ -283,7 +283,6 @@ static int lapbeth_open(struct net_devic + return -ENODEV; + } + +- netif_start_queue(dev); + return 0; + } + +@@ -291,8 +290,6 @@ static int lapbeth_close(struct net_devi + { + int err; + +- netif_stop_queue(dev); +- + if ((err = lapb_unregister(dev)) != LAPB_OK) + pr_err("lapb_unregister error: %d\n", err); + diff --git a/queue-5.4/net-qrtr-fix-error-return-code-of-qrtr_sendmsg.patch b/queue-5.4/net-qrtr-fix-error-return-code-of-qrtr_sendmsg.patch new file mode 100644 index 00000000000..43429e651df --- /dev/null +++ b/queue-5.4/net-qrtr-fix-error-return-code-of-qrtr_sendmsg.patch @@ -0,0 +1,36 @@ +From 179d0ba0c454057a65929c46af0d6ad986754781 Mon Sep 17 00:00:00 2001 +From: Jia-Ju Bai +Date: Mon, 8 Mar 2021 01:13:55 -0800 +Subject: net: qrtr: fix error return code of qrtr_sendmsg() + +From: Jia-Ju Bai + +commit 179d0ba0c454057a65929c46af0d6ad986754781 upstream. + +When sock_alloc_send_skb() returns NULL to skb, no error return code of +qrtr_sendmsg() is assigned. +To fix this bug, rc is assigned with -ENOMEM in this case. + +Fixes: 194ccc88297a ("net: qrtr: Support decoding incoming v2 packets") +Reported-by: TOTE Robot +Signed-off-by: Jia-Ju Bai +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/qrtr/qrtr.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/net/qrtr/qrtr.c ++++ b/net/qrtr/qrtr.c +@@ -791,8 +791,10 @@ static int qrtr_sendmsg(struct socket *s + plen = (len + 3) & ~3; + skb = sock_alloc_send_skb(sk, plen + QRTR_HDR_MAX_SIZE, + msg->msg_flags & MSG_DONTWAIT, &rc); +- if (!skb) ++ if (!skb) { ++ rc = -ENOMEM; + goto out_node; ++ } + + skb_reserve(skb, QRTR_HDR_MAX_SIZE); + diff --git a/queue-5.4/net-sched-avoid-duplicates-in-classes-dump.patch b/queue-5.4/net-sched-avoid-duplicates-in-classes-dump.patch new file mode 100644 index 00000000000..8e832c6e5c0 --- /dev/null +++ b/queue-5.4/net-sched-avoid-duplicates-in-classes-dump.patch @@ -0,0 +1,60 @@ +From bfc2560563586372212b0a8aeca7428975fa91fe Mon Sep 17 00:00:00 2001 +From: Maximilian Heyne +Date: Thu, 4 Mar 2021 14:43:17 +0000 +Subject: net: sched: avoid duplicates in classes dump + +From: Maximilian Heyne + +commit bfc2560563586372212b0a8aeca7428975fa91fe upstream. + +This is a follow up of commit ea3274695353 ("net: sched: avoid +duplicates in qdisc dump") which has fixed the issue only for the qdisc +dump. + +The duplicate printing also occurs when dumping the classes via + tc class show dev eth0 + +Fixes: 59cc1f61f09c ("net: sched: convert qdisc linked list to hashtable") +Signed-off-by: Maximilian Heyne +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/sched/sch_api.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/net/sched/sch_api.c ++++ b/net/sched/sch_api.c +@@ -2157,7 +2157,7 @@ static int tc_dump_tclass_qdisc(struct Q + + static int tc_dump_tclass_root(struct Qdisc *root, struct sk_buff *skb, + struct tcmsg *tcm, struct netlink_callback *cb, +- int *t_p, int s_t) ++ int *t_p, int s_t, bool recur) + { + struct Qdisc *q; + int b; +@@ -2168,7 +2168,7 @@ static int tc_dump_tclass_root(struct Qd + if (tc_dump_tclass_qdisc(root, skb, tcm, cb, t_p, s_t) < 0) + return -1; + +- if (!qdisc_dev(root)) ++ if (!qdisc_dev(root) || !recur) + return 0; + + if (tcm->tcm_parent) { +@@ -2203,13 +2203,13 @@ static int tc_dump_tclass(struct sk_buff + s_t = cb->args[0]; + t = 0; + +- if (tc_dump_tclass_root(dev->qdisc, skb, tcm, cb, &t, s_t) < 0) ++ if (tc_dump_tclass_root(dev->qdisc, skb, tcm, cb, &t, s_t, true) < 0) + goto done; + + dev_queue = dev_ingress_queue(dev); + if (dev_queue && + tc_dump_tclass_root(dev_queue->qdisc_sleeping, skb, tcm, cb, +- &t, s_t) < 0) ++ &t, s_t, false) < 0) + goto done; + + done: diff --git a/queue-5.4/net-stmmac-fix-watchdog-timeout-during-suspend-resume-stress-test.patch b/queue-5.4/net-stmmac-fix-watchdog-timeout-during-suspend-resume-stress-test.patch new file mode 100644 index 00000000000..2cbb173006e --- /dev/null +++ b/queue-5.4/net-stmmac-fix-watchdog-timeout-during-suspend-resume-stress-test.patch @@ -0,0 +1,43 @@ +From c511819d138de38e1637eedb645c207e09680d0f Mon Sep 17 00:00:00 2001 +From: Joakim Zhang +Date: Thu, 25 Feb 2021 17:01:11 +0800 +Subject: net: stmmac: fix watchdog timeout during suspend/resume stress test + +From: Joakim Zhang + +commit c511819d138de38e1637eedb645c207e09680d0f upstream. + +stmmac_xmit() call stmmac_tx_timer_arm() at the end to modify tx timer to +do the transmission cleanup work. Imagine such a situation, stmmac enters +suspend immediately after tx timer modified, it's expire callback +stmmac_tx_clean() would not be invoked. This could affect BQL, since +netdev_tx_sent_queue() has been called, but netdev_tx_completed_queue() +have not been involved, as a result, dql_avail(&dev_queue->dql) finally +always return a negative value. + +__dev_queue_xmit->__dev_xmit_skb->qdisc_run->__qdisc_run->qdisc_restart->dequeue_skb: + if ((q->flags & TCQ_F_ONETXQUEUE) && + netif_xmit_frozen_or_stopped(txq)) // __QUEUE_STATE_STACK_XOFF is set + +Net core will stop transmitting any more. Finillay, net watchdong would timeout. +To fix this issue, we should call netdev_tx_reset_queue() in stmmac_resume(). + +Fixes: 54139cf3bb33 ("net: stmmac: adding multiple buffers for rx") +Signed-off-by: Joakim Zhang +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +@@ -4821,6 +4821,8 @@ static void stmmac_reset_queues_param(st + tx_q->cur_tx = 0; + tx_q->dirty_tx = 0; + tx_q->mss = 0; ++ ++ netdev_tx_reset_queue(netdev_get_tx_queue(priv->dev, queue)); + } + } + diff --git a/queue-5.4/net-stmmac-stop-each-tx-channel-independently.patch b/queue-5.4/net-stmmac-stop-each-tx-channel-independently.patch new file mode 100644 index 00000000000..9a898315669 --- /dev/null +++ b/queue-5.4/net-stmmac-stop-each-tx-channel-independently.patch @@ -0,0 +1,33 @@ +From a3e860a83397bf761ec1128a3f0ba186445992c6 Mon Sep 17 00:00:00 2001 +From: Joakim Zhang +Date: Thu, 25 Feb 2021 17:01:10 +0800 +Subject: net: stmmac: stop each tx channel independently + +From: Joakim Zhang + +commit a3e860a83397bf761ec1128a3f0ba186445992c6 upstream. + +If clear GMAC_CONFIG_TE bit, it would stop all tx channels, but users +may only want to stop specific tx channel. + +Fixes: 48863ce5940f ("stmmac: add DMA support for GMAC 4.xx") +Signed-off-by: Joakim Zhang +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/stmicro/stmmac/dwmac4_lib.c | 4 ---- + 1 file changed, 4 deletions(-) + +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_lib.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_lib.c +@@ -60,10 +60,6 @@ void dwmac4_dma_stop_tx(void __iomem *io + + value &= ~DMA_CONTROL_ST; + writel(value, ioaddr + DMA_CHAN_TX_CONTROL(chan)); +- +- value = readl(ioaddr + GMAC_CONFIG); +- value &= ~GMAC_CONFIG_TE; +- writel(value, ioaddr + GMAC_CONFIG); + } + + void dwmac4_dma_start_rx(void __iomem *ioaddr, u32 chan) diff --git a/queue-5.4/net-usb-qmi_wwan-allow-qmimux-add-del-with-master-up.patch b/queue-5.4/net-usb-qmi_wwan-allow-qmimux-add-del-with-master-up.patch new file mode 100644 index 00000000000..339dd566655 --- /dev/null +++ b/queue-5.4/net-usb-qmi_wwan-allow-qmimux-add-del-with-master-up.patch @@ -0,0 +1,60 @@ +From 6c59cff38e66584ae3ac6c2f0cbd8d039c710ba7 Mon Sep 17 00:00:00 2001 +From: Daniele Palmas +Date: Thu, 4 Mar 2021 14:15:13 +0100 +Subject: net: usb: qmi_wwan: allow qmimux add/del with master up +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Daniele Palmas + +commit 6c59cff38e66584ae3ac6c2f0cbd8d039c710ba7 upstream. + +There's no reason for preventing the creation and removal +of qmimux network interfaces when the underlying interface +is up. + +This makes qmi_wwan mux implementation more similar to the +rmnet one, simplifying userspace management of the same +logical interfaces. + +Fixes: c6adf77953bc ("net: usb: qmi_wwan: add qmap mux protocol support") +Reported-by: Aleksander Morgado +Signed-off-by: Daniele Palmas +Acked-by: Bjørn Mork +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/usb/qmi_wwan.c | 14 -------------- + 1 file changed, 14 deletions(-) + +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -441,13 +441,6 @@ static ssize_t add_mux_store(struct devi + goto err; + } + +- /* we don't want to modify a running netdev */ +- if (netif_running(dev->net)) { +- netdev_err(dev->net, "Cannot change a running device\n"); +- ret = -EBUSY; +- goto err; +- } +- + ret = qmimux_register_device(dev->net, mux_id); + if (!ret) { + info->flags |= QMI_WWAN_FLAG_MUX; +@@ -477,13 +470,6 @@ static ssize_t del_mux_store(struct devi + if (!rtnl_trylock()) + return restart_syscall(); + +- /* we don't want to modify a running netdev */ +- if (netif_running(dev->net)) { +- netdev_err(dev->net, "Cannot change a running device\n"); +- ret = -EBUSY; +- goto err; +- } +- + del_dev = qmimux_find_dev(dev, mux_id); + if (!del_dev) { + netdev_err(dev->net, "mux_id not present\n"); diff --git a/queue-5.4/netdevsim-init-u64-stats-for-32bit-hardware.patch b/queue-5.4/netdevsim-init-u64-stats-for-32bit-hardware.patch new file mode 100644 index 00000000000..fda61c8e17c --- /dev/null +++ b/queue-5.4/netdevsim-init-u64-stats-for-32bit-hardware.patch @@ -0,0 +1,86 @@ +From 863a42b289c22df63db62b10fc2c2ffc237e2125 Mon Sep 17 00:00:00 2001 +From: Hillf Danton +Date: Thu, 4 Mar 2021 10:30:09 -0800 +Subject: netdevsim: init u64 stats for 32bit hardware + +From: Hillf Danton + +commit 863a42b289c22df63db62b10fc2c2ffc237e2125 upstream. + +Init the u64 stats in order to avoid the lockdep prints on the 32bit +hardware like + + INFO: trying to register non-static key. + the code is fine but needs lockdep annotation. + turning off the locking correctness validator. + CPU: 0 PID: 4695 Comm: syz-executor.0 Not tainted 5.11.0-rc5-syzkaller #0 + Hardware name: ARM-Versatile Express + Backtrace: + [<826fc5b8>] (dump_backtrace) from [<826fc82c>] (show_stack+0x18/0x1c arch/arm/kernel/traps.c:252) + [<826fc814>] (show_stack) from [<8270d1f8>] (__dump_stack lib/dump_stack.c:79 [inline]) + [<826fc814>] (show_stack) from [<8270d1f8>] (dump_stack+0xa8/0xc8 lib/dump_stack.c:120) + [<8270d150>] (dump_stack) from [<802bf9c0>] (assign_lock_key kernel/locking/lockdep.c:935 [inline]) + [<8270d150>] (dump_stack) from [<802bf9c0>] (register_lock_class+0xabc/0xb68 kernel/locking/lockdep.c:1247) + [<802bef04>] (register_lock_class) from [<802baa2c>] (__lock_acquire+0x84/0x32d4 kernel/locking/lockdep.c:4711) + [<802ba9a8>] (__lock_acquire) from [<802be840>] (lock_acquire.part.0+0xf0/0x554 kernel/locking/lockdep.c:5442) + [<802be750>] (lock_acquire.part.0) from [<802bed10>] (lock_acquire+0x6c/0x74 kernel/locking/lockdep.c:5415) + [<802beca4>] (lock_acquire) from [<81560548>] (seqcount_lockdep_reader_access include/linux/seqlock.h:103 [inline]) + [<802beca4>] (lock_acquire) from [<81560548>] (__u64_stats_fetch_begin include/linux/u64_stats_sync.h:164 [inline]) + [<802beca4>] (lock_acquire) from [<81560548>] (u64_stats_fetch_begin include/linux/u64_stats_sync.h:175 [inline]) + [<802beca4>] (lock_acquire) from [<81560548>] (nsim_get_stats64+0xdc/0xf0 drivers/net/netdevsim/netdev.c:70) + [<8156046c>] (nsim_get_stats64) from [<81e2efa0>] (dev_get_stats+0x44/0xd0 net/core/dev.c:10405) + [<81e2ef5c>] (dev_get_stats) from [<81e53204>] (rtnl_fill_stats+0x38/0x120 net/core/rtnetlink.c:1211) + [<81e531cc>] (rtnl_fill_stats) from [<81e59d58>] (rtnl_fill_ifinfo+0x6d4/0x148c net/core/rtnetlink.c:1783) + [<81e59684>] (rtnl_fill_ifinfo) from [<81e5ceb4>] (rtmsg_ifinfo_build_skb+0x9c/0x108 net/core/rtnetlink.c:3798) + [<81e5ce18>] (rtmsg_ifinfo_build_skb) from [<81e5d0ac>] (rtmsg_ifinfo_event net/core/rtnetlink.c:3830 [inline]) + [<81e5ce18>] (rtmsg_ifinfo_build_skb) from [<81e5d0ac>] (rtmsg_ifinfo_event net/core/rtnetlink.c:3821 [inline]) + [<81e5ce18>] (rtmsg_ifinfo_build_skb) from [<81e5d0ac>] (rtmsg_ifinfo+0x44/0x70 net/core/rtnetlink.c:3839) + [<81e5d068>] (rtmsg_ifinfo) from [<81e45c2c>] (register_netdevice+0x664/0x68c net/core/dev.c:10103) + [<81e455c8>] (register_netdevice) from [<815608bc>] (nsim_create+0xf8/0x124 drivers/net/netdevsim/netdev.c:317) + [<815607c4>] (nsim_create) from [<81561184>] (__nsim_dev_port_add+0x108/0x188 drivers/net/netdevsim/dev.c:941) + [<8156107c>] (__nsim_dev_port_add) from [<815620d8>] (nsim_dev_port_add_all drivers/net/netdevsim/dev.c:990 [inline]) + [<8156107c>] (__nsim_dev_port_add) from [<815620d8>] (nsim_dev_probe+0x5cc/0x750 drivers/net/netdevsim/dev.c:1119) + [<81561b0c>] (nsim_dev_probe) from [<815661dc>] (nsim_bus_probe+0x10/0x14 drivers/net/netdevsim/bus.c:287) + [<815661cc>] (nsim_bus_probe) from [<811724c0>] (really_probe+0x100/0x50c drivers/base/dd.c:554) + [<811723c0>] (really_probe) from [<811729c4>] (driver_probe_device+0xf8/0x1c8 drivers/base/dd.c:740) + [<811728cc>] (driver_probe_device) from [<81172fe4>] (__device_attach_driver+0x8c/0xf0 drivers/base/dd.c:846) + [<81172f58>] (__device_attach_driver) from [<8116fee0>] (bus_for_each_drv+0x88/0xd8 drivers/base/bus.c:431) + [<8116fe58>] (bus_for_each_drv) from [<81172c6c>] (__device_attach+0xdc/0x1d0 drivers/base/dd.c:914) + [<81172b90>] (__device_attach) from [<8117305c>] (device_initial_probe+0x14/0x18 drivers/base/dd.c:961) + [<81173048>] (device_initial_probe) from [<81171358>] (bus_probe_device+0x90/0x98 drivers/base/bus.c:491) + [<811712c8>] (bus_probe_device) from [<8116e77c>] (device_add+0x320/0x824 drivers/base/core.c:3109) + [<8116e45c>] (device_add) from [<8116ec9c>] (device_register+0x1c/0x20 drivers/base/core.c:3182) + [<8116ec80>] (device_register) from [<81566710>] (nsim_bus_dev_new drivers/net/netdevsim/bus.c:336 [inline]) + [<8116ec80>] (device_register) from [<81566710>] (new_device_store+0x178/0x208 drivers/net/netdevsim/bus.c:215) + [<81566598>] (new_device_store) from [<8116fcb4>] (bus_attr_store+0x2c/0x38 drivers/base/bus.c:122) + [<8116fc88>] (bus_attr_store) from [<805b4b8c>] (sysfs_kf_write+0x48/0x54 fs/sysfs/file.c:139) + [<805b4b44>] (sysfs_kf_write) from [<805b3c90>] (kernfs_fop_write_iter+0x128/0x1ec fs/kernfs/file.c:296) + [<805b3b68>] (kernfs_fop_write_iter) from [<804d22fc>] (call_write_iter include/linux/fs.h:1901 [inline]) + [<805b3b68>] (kernfs_fop_write_iter) from [<804d22fc>] (new_sync_write fs/read_write.c:518 [inline]) + [<805b3b68>] (kernfs_fop_write_iter) from [<804d22fc>] (vfs_write+0x3dc/0x57c fs/read_write.c:605) + [<804d1f20>] (vfs_write) from [<804d2604>] (ksys_write+0x68/0xec fs/read_write.c:658) + [<804d259c>] (ksys_write) from [<804d2698>] (__do_sys_write fs/read_write.c:670 [inline]) + [<804d259c>] (ksys_write) from [<804d2698>] (sys_write+0x10/0x14 fs/read_write.c:667) + [<804d2688>] (sys_write) from [<80200060>] (ret_fast_syscall+0x0/0x2c arch/arm/mm/proc-v7.S:64) + +Fixes: 83c9e13aa39a ("netdevsim: add software driver for testing offloads") +Reported-by: syzbot+e74a6857f2d0efe3ad81@syzkaller.appspotmail.com +Tested-by: Dmitry Vyukov +Signed-off-by: Hillf Danton +Signed-off-by: Jakub Kicinski +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/netdevsim/netdev.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/netdevsim/netdev.c ++++ b/drivers/net/netdevsim/netdev.c +@@ -292,6 +292,7 @@ nsim_create(struct nsim_dev *nsim_dev, s + + ns = netdev_priv(dev); + ns->netdev = dev; ++ u64_stats_init(&ns->syncp); + ns->nsim_dev = nsim_dev; + ns->nsim_dev_port = nsim_dev_port; + ns->nsim_bus_dev = nsim_dev->nsim_bus_dev; diff --git a/queue-5.4/perf-traceevent-ensure-read-cmdlines-are-null-terminated.patch b/queue-5.4/perf-traceevent-ensure-read-cmdlines-are-null-terminated.patch new file mode 100644 index 00000000000..4b432598543 --- /dev/null +++ b/queue-5.4/perf-traceevent-ensure-read-cmdlines-are-null-terminated.patch @@ -0,0 +1,36 @@ +From 137a5258939aca56558f3a23eb229b9c4b293917 Mon Sep 17 00:00:00 2001 +From: Ian Rogers +Date: Fri, 26 Feb 2021 14:14:31 -0800 +Subject: perf traceevent: Ensure read cmdlines are null terminated. + +From: Ian Rogers + +commit 137a5258939aca56558f3a23eb229b9c4b293917 upstream. + +Issue detected by address sanitizer. + +Fixes: cd4ceb63438e9e28 ("perf util: Save pid-cmdline mapping into tracing header") +Signed-off-by: Ian Rogers +Acked-by: Namhyung Kim +Cc: Alexander Shishkin +Cc: Jiri Olsa +Cc: Mark Rutland +Cc: Peter Zijlstra +Cc: Stephane Eranian +Link: http://lore.kernel.org/lkml/20210226221431.1985458-1-irogers@google.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/util/trace-event-read.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/tools/perf/util/trace-event-read.c ++++ b/tools/perf/util/trace-event-read.c +@@ -361,6 +361,7 @@ static int read_saved_cmdline(struct tep + pr_debug("error reading saved cmdlines\n"); + goto out; + } ++ buf[ret] = '\0'; + + parse_saved_cmdline(pevent, buf, size); + ret = 0; diff --git a/queue-5.4/s390-cio-return-efault-if-copy_to_user-fails.patch b/queue-5.4/s390-cio-return-efault-if-copy_to_user-fails.patch new file mode 100644 index 00000000000..72d9ff1a2c2 --- /dev/null +++ b/queue-5.4/s390-cio-return-efault-if-copy_to_user-fails.patch @@ -0,0 +1,42 @@ +From 51c44babdc19aaf882e1213325a0ba291573308f Mon Sep 17 00:00:00 2001 +From: Wang Qing +Date: Mon, 1 Mar 2021 20:01:33 +0800 +Subject: s390/cio: return -EFAULT if copy_to_user() fails + +From: Wang Qing + +commit 51c44babdc19aaf882e1213325a0ba291573308f upstream. + +The copy_to_user() function returns the number of bytes remaining to be +copied, but we want to return -EFAULT if the copy doesn't complete. + +Fixes: e01bcdd61320 ("vfio: ccw: realize VFIO_DEVICE_GET_REGION_INFO ioctl") +Signed-off-by: Wang Qing +Signed-off-by: Heiko Carstens +Link: https://lore.kernel.org/r/1614600093-13992-1-git-send-email-wangqing@vivo.com +Signed-off-by: Heiko Carstens +Signed-off-by: Greg Kroah-Hartman +--- + drivers/s390/cio/vfio_ccw_ops.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/s390/cio/vfio_ccw_ops.c ++++ b/drivers/s390/cio/vfio_ccw_ops.c +@@ -506,7 +506,7 @@ static ssize_t vfio_ccw_mdev_ioctl(struc + if (ret) + return ret; + +- return copy_to_user((void __user *)arg, &info, minsz); ++ return copy_to_user((void __user *)arg, &info, minsz) ? -EFAULT : 0; + } + case VFIO_DEVICE_GET_REGION_INFO: + { +@@ -524,7 +524,7 @@ static ssize_t vfio_ccw_mdev_ioctl(struc + if (ret) + return ret; + +- return copy_to_user((void __user *)arg, &info, minsz); ++ return copy_to_user((void __user *)arg, &info, minsz) ? -EFAULT : 0; + } + case VFIO_DEVICE_GET_IRQ_INFO: + { diff --git a/queue-5.4/selftests-forwarding-fix-race-condition-in-mirror-installation.patch b/queue-5.4/selftests-forwarding-fix-race-condition-in-mirror-installation.patch new file mode 100644 index 00000000000..add5df4a4c2 --- /dev/null +++ b/queue-5.4/selftests-forwarding-fix-race-condition-in-mirror-installation.patch @@ -0,0 +1,54 @@ +From edcbf5137f093b5502f5f6b97cce3cbadbde27aa Mon Sep 17 00:00:00 2001 +From: Danielle Ratson +Date: Thu, 25 Feb 2021 18:57:19 +0200 +Subject: selftests: forwarding: Fix race condition in mirror installation + +From: Danielle Ratson + +commit edcbf5137f093b5502f5f6b97cce3cbadbde27aa upstream. + +When mirroring to a gretap in hardware the device expects to be +programmed with the egress port and all the encapsulating headers. This +requires the driver to resolve the path the packet will take in the +software data path and program the device accordingly. + +If the path cannot be resolved (in this case because of an unresolved +neighbor), then mirror installation fails until the path is resolved. +This results in a race that causes the test to sometimes fail. + +Fix this by setting the neighbor's state to permanent, so that it is +always valid. + +Fixes: b5b029399fa6d ("selftests: forwarding: mirror_gre_bridge_1d_vlan: Add STP test") +Signed-off-by: Danielle Ratson +Reviewed-by: Petr Machata +Signed-off-by: Ido Schimmel +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/net/forwarding/mirror_gre_bridge_1d_vlan.sh | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/tools/testing/selftests/net/forwarding/mirror_gre_bridge_1d_vlan.sh ++++ b/tools/testing/selftests/net/forwarding/mirror_gre_bridge_1d_vlan.sh +@@ -86,11 +86,20 @@ test_ip6gretap() + + test_gretap_stp() + { ++ # Sometimes after mirror installation, the neighbor's state is not valid. ++ # The reason is that there is no SW datapath activity related to the ++ # neighbor for the remote GRE address. Therefore whether the corresponding ++ # neighbor will be valid is a matter of luck, and the test is thus racy. ++ # Set the neighbor's state to permanent, so it would be always valid. ++ ip neigh replace 192.0.2.130 lladdr $(mac_get $h3) \ ++ nud permanent dev br2 + full_test_span_gre_stp gt4 $swp3.555 "mirror to gretap" + } + + test_ip6gretap_stp() + { ++ ip neigh replace 2001:db8:2::2 lladdr $(mac_get $h3) \ ++ nud permanent dev br2 + full_test_span_gre_stp gt6 $swp3.555 "mirror to ip6gretap" + } + diff --git a/queue-5.4/series b/queue-5.4/series index c0f0730128a..272d6712145 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -29,3 +29,21 @@ net-enetc-keep-rx-ring-consumer-index-in-sync-with-hardware.patch net-mlx4_en-update-moderation-when-config-reset.patch net-stmmac-fix-incorrect-dma-channel-intr-enable-setting-of-eqos-v4.10.patch nexthop-do-not-flush-blackhole-nexthops-when-loopback-goes-down.patch +net-sched-avoid-duplicates-in-classes-dump.patch +net-usb-qmi_wwan-allow-qmimux-add-del-with-master-up.patch +netdevsim-init-u64-stats-for-32bit-hardware.patch +cipso-calipso-resolve-a-number-of-problems-with-the-doi-refcounts.patch +net-lapbether-remove-netif_start_queue-netif_stop_queue.patch +net-davicom-fix-regulator-not-turned-off-on-failed-probe.patch +net-davicom-fix-regulator-not-turned-off-on-driver-removal.patch +net-bonding-fix-error-return-code-of-bond_neigh_init.patch +net-qrtr-fix-error-return-code-of-qrtr_sendmsg.patch +ixgbe-fail-to-create-xfrm-offload-of-ipsec-tunnel-mode-sa.patch +net-stmmac-stop-each-tx-channel-independently.patch +net-stmmac-fix-watchdog-timeout-during-suspend-resume-stress-test.patch +selftests-forwarding-fix-race-condition-in-mirror-installation.patch +perf-traceevent-ensure-read-cmdlines-are-null-terminated.patch +net-hns3-fix-query-vlan-mask-value-error-for-flow-director.patch +net-hns3-fix-bug-when-calculating-the-tcam-table-info.patch +s390-cio-return-efault-if-copy_to_user-fails.patch +bnxt_en-reliably-allocate-irq-table-on-reset-to-avoid-crash.patch