From: Greg Kroah-Hartman Date: Fri, 15 Jan 2021 08:52:23 +0000 (+0100) Subject: 4.19-stable patches X-Git-Tag: v4.4.252~29 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=165bbc225f701f658c7ba8f6f6e21a79293f3595;p=thirdparty%2Fkernel%2Fstable-queue.git 4.19-stable patches added patches: chtls-added-a-check-to-avoid-null-pointer-dereference.patch chtls-fix-chtls-resources-release-sequence.patch chtls-fix-hardware-tid-leak.patch chtls-fix-panic-when-route-to-peer-not-configured.patch chtls-remove-invalid-set_tcb-call.patch chtls-replace-skb_dequeue-with-skb_peek.patch net-cdc_ncm-correct-overhead-in-delayed_ndp_size.patch net-fix-pmtu-check-in-nopmtudisc-mode.patch net-hns3-fix-the-number-of-queues-actually-used-by-arq.patch net-ip-always-refragment-ip-defragmented-packets.patch net-ipv6-fib-flush-exceptions-when-purging-route.patch net-sonic-fix-some-resource-leaks-in-error-handling-paths.patch net-stmmac-dwmac-sun8i-balance-internal-phy-power.patch net-stmmac-dwmac-sun8i-balance-internal-phy-resource-references.patch net-vlan-avoid-leaks-on-register_vlan_dev-failures.patch --- diff --git a/queue-4.19/chtls-added-a-check-to-avoid-null-pointer-dereference.patch b/queue-4.19/chtls-added-a-check-to-avoid-null-pointer-dereference.patch new file mode 100644 index 00000000000..d85df8f6c58 --- /dev/null +++ b/queue-4.19/chtls-added-a-check-to-avoid-null-pointer-dereference.patch @@ -0,0 +1,35 @@ +From foo@baz Fri Jan 15 09:43:29 AM CET 2021 +From: Ayush Sawal +Date: Wed, 6 Jan 2021 09:59:11 +0530 +Subject: chtls: Added a check to avoid NULL pointer dereference + +From: Ayush Sawal + +[ Upstream commit eade1e0a4fb31d48eeb1589d9bb859ae4dd6181d ] + +In case of server removal lookup_stid() may return NULL pointer, which +is used as listen_ctx. So added a check before accessing this pointer. + +Fixes: cc35c88ae4db ("crypto : chtls - CPL handler definition") +Signed-off-by: Vinay Kumar Yadav +Signed-off-by: Ayush Sawal +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/crypto/chelsio/chtls/chtls_cm.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/crypto/chelsio/chtls/chtls_cm.c ++++ b/drivers/crypto/chelsio/chtls/chtls_cm.c +@@ -1432,6 +1432,11 @@ static int chtls_pass_establish(struct c + sk_wake_async(sk, 0, POLL_OUT); + + data = lookup_stid(cdev->tids, stid); ++ if (!data) { ++ /* listening server close */ ++ kfree_skb(skb); ++ goto unlock; ++ } + lsk = ((struct listen_ctx *)data)->lsk; + + bh_lock_sock(lsk); diff --git a/queue-4.19/chtls-fix-chtls-resources-release-sequence.patch b/queue-4.19/chtls-fix-chtls-resources-release-sequence.patch new file mode 100644 index 00000000000..d7020d6872a --- /dev/null +++ b/queue-4.19/chtls-fix-chtls-resources-release-sequence.patch @@ -0,0 +1,61 @@ +From foo@baz Fri Jan 15 08:22:25 AM CET 2021 +From: Ayush Sawal +Date: Wed, 6 Jan 2021 09:59:12 +0530 +Subject: chtls: Fix chtls resources release sequence + +From: Ayush Sawal + +[ Upstream commit 15ef6b0e30b354253e2c10b3836bc59767eb162b ] + +CPL_ABORT_RPL is sent after releasing the resources by calling +chtls_release_resources(sk); and chtls_conn_done(sk); +eventually causing kernel panic. Fixing it by calling release +in appropriate order. + +Fixes: cc35c88ae4db ("crypto : chtls - CPL handler definition") +Signed-off-by: Vinay Kumar Yadav +Signed-off-by: Ayush Sawal +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/crypto/chelsio/chtls/chtls_cm.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +--- a/drivers/crypto/chelsio/chtls/chtls_cm.c ++++ b/drivers/crypto/chelsio/chtls/chtls_cm.c +@@ -1884,9 +1884,9 @@ static void bl_abort_syn_rcv(struct sock + queue = csk->txq_idx; + + skb->sk = NULL; +- do_abort_syn_rcv(child, lsk); + chtls_send_abort_rpl(child, skb, BLOG_SKB_CB(skb)->cdev, + CPL_ABORT_NO_RST, queue); ++ do_abort_syn_rcv(child, lsk); + } + + static int abort_syn_rcv(struct sock *sk, struct sk_buff *skb) +@@ -1916,8 +1916,8 @@ static int abort_syn_rcv(struct sock *sk + if (!sock_owned_by_user(psk)) { + int queue = csk->txq_idx; + +- do_abort_syn_rcv(sk, psk); + chtls_send_abort_rpl(sk, skb, cdev, CPL_ABORT_NO_RST, queue); ++ do_abort_syn_rcv(sk, psk); + } else { + skb->sk = sk; + BLOG_SKB_CB(skb)->backlog_rcv = bl_abort_syn_rcv; +@@ -1960,12 +1960,11 @@ static void chtls_abort_req_rss(struct s + + if (sk->sk_state == TCP_SYN_RECV && !abort_syn_rcv(sk, skb)) + return; +- +- chtls_release_resources(sk); +- chtls_conn_done(sk); + } + + chtls_send_abort_rpl(sk, skb, csk->cdev, rst_status, queue); ++ chtls_release_resources(sk); ++ chtls_conn_done(sk); + } + + static void chtls_abort_rpl_rss(struct sock *sk, struct sk_buff *skb) diff --git a/queue-4.19/chtls-fix-hardware-tid-leak.patch b/queue-4.19/chtls-fix-hardware-tid-leak.patch new file mode 100644 index 00000000000..f31f6406b7a --- /dev/null +++ b/queue-4.19/chtls-fix-hardware-tid-leak.patch @@ -0,0 +1,85 @@ +From foo@baz Fri Jan 15 08:22:25 AM CET 2021 +From: Ayush Sawal +Date: Wed, 6 Jan 2021 09:59:06 +0530 +Subject: chtls: Fix hardware tid leak + +From: Ayush Sawal + +[ Upstream commit 717df0f4cdc9044c415431a3522b3e9ccca5b4a3 ] + +send_abort_rpl() is not calculating cpl_abort_req_rss offset and +ends up sending wrong TID with abort_rpl WR causng tid leaks. +Replaced send_abort_rpl() with chtls_send_abort_rpl() as it is +redundant. + +Fixes: cc35c88ae4db ("crypto : chtls - CPL handler definition") +Signed-off-by: Rohit Maheshwari +Signed-off-by: Ayush Sawal +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/crypto/chelsio/chtls/chtls_cm.c | 39 ++------------------------------ + 1 file changed, 3 insertions(+), 36 deletions(-) + +--- a/drivers/crypto/chelsio/chtls/chtls_cm.c ++++ b/drivers/crypto/chelsio/chtls/chtls_cm.c +@@ -1807,39 +1807,6 @@ static void send_defer_abort_rpl(struct + kfree_skb(skb); + } + +-static void send_abort_rpl(struct sock *sk, struct sk_buff *skb, +- struct chtls_dev *cdev, int status, int queue) +-{ +- struct cpl_abort_req_rss *req = cplhdr(skb); +- struct sk_buff *reply_skb; +- struct chtls_sock *csk; +- +- csk = rcu_dereference_sk_user_data(sk); +- +- reply_skb = alloc_skb(sizeof(struct cpl_abort_rpl), +- GFP_KERNEL); +- +- if (!reply_skb) { +- req->status = (queue << 1); +- send_defer_abort_rpl(cdev, skb); +- return; +- } +- +- set_abort_rpl_wr(reply_skb, GET_TID(req), status); +- kfree_skb(skb); +- +- set_wr_txq(reply_skb, CPL_PRIORITY_DATA, queue); +- if (csk_conn_inline(csk)) { +- struct l2t_entry *e = csk->l2t_entry; +- +- if (e && sk->sk_state != TCP_SYN_RECV) { +- cxgb4_l2t_send(csk->egress_dev, reply_skb, e); +- return; +- } +- } +- cxgb4_ofld_send(cdev->lldi->ports[0], reply_skb); +-} +- + /* + * Add an skb to the deferred skb queue for processing from process context. + */ +@@ -1903,8 +1870,8 @@ static void bl_abort_syn_rcv(struct sock + + skb->sk = NULL; + do_abort_syn_rcv(child, lsk); +- send_abort_rpl(child, skb, BLOG_SKB_CB(skb)->cdev, +- CPL_ABORT_NO_RST, queue); ++ chtls_send_abort_rpl(child, skb, BLOG_SKB_CB(skb)->cdev, ++ CPL_ABORT_NO_RST, queue); + } + + static int abort_syn_rcv(struct sock *sk, struct sk_buff *skb) +@@ -1935,7 +1902,7 @@ static int abort_syn_rcv(struct sock *sk + int queue = csk->txq_idx; + + do_abort_syn_rcv(sk, psk); +- send_abort_rpl(sk, skb, cdev, CPL_ABORT_NO_RST, queue); ++ chtls_send_abort_rpl(sk, skb, cdev, CPL_ABORT_NO_RST, queue); + } else { + skb->sk = sk; + BLOG_SKB_CB(skb)->backlog_rcv = bl_abort_syn_rcv; diff --git a/queue-4.19/chtls-fix-panic-when-route-to-peer-not-configured.patch b/queue-4.19/chtls-fix-panic-when-route-to-peer-not-configured.patch new file mode 100644 index 00000000000..8a6980d8217 --- /dev/null +++ b/queue-4.19/chtls-fix-panic-when-route-to-peer-not-configured.patch @@ -0,0 +1,75 @@ +From foo@baz Fri Jan 15 08:22:25 AM CET 2021 +From: Ayush Sawal +Date: Wed, 6 Jan 2021 09:59:08 +0530 +Subject: chtls: Fix panic when route to peer not configured + +From: Ayush Sawal + +[ Upstream commit 5a5fac9966bb6d513198634b0b1357be7e8447d2 ] + +If route to peer is not configured, we might get non tls +devices from dst_neigh_lookup() which is invalid, adding a +check to avoid it. + +Fixes: cc35c88ae4db ("crypto : chtls - CPL handler definition") +Signed-off-by: Rohit Maheshwari +Signed-off-by: Ayush Sawal +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/crypto/chelsio/chtls/chtls_cm.c | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +--- a/drivers/crypto/chelsio/chtls/chtls_cm.c ++++ b/drivers/crypto/chelsio/chtls/chtls_cm.c +@@ -1024,6 +1024,7 @@ static struct sock *chtls_recv_sock(stru + const struct cpl_pass_accept_req *req, + struct chtls_dev *cdev) + { ++ struct adapter *adap = pci_get_drvdata(cdev->pdev); + const struct tcphdr *tcph; + struct inet_sock *newinet; + const struct iphdr *iph; +@@ -1033,9 +1034,10 @@ static struct sock *chtls_recv_sock(stru + struct neighbour *n; + struct tcp_sock *tp; + struct sock *newsk; ++ bool found = false; + u16 port_id; + int rxq_idx; +- int step; ++ int step, i; + + iph = (const struct iphdr *)network_hdr; + newsk = tcp_create_openreq_child(lsk, oreq, cdev->askb); +@@ -1048,7 +1050,7 @@ static struct sock *chtls_recv_sock(stru + + tcph = (struct tcphdr *)(iph + 1); + n = dst_neigh_lookup(dst, &iph->saddr); +- if (!n) ++ if (!n || !n->dev) + goto free_sk; + + ndev = n->dev; +@@ -1057,6 +1059,13 @@ static struct sock *chtls_recv_sock(stru + if (is_vlan_dev(ndev)) + ndev = vlan_dev_real_dev(ndev); + ++ for_each_port(adap, i) ++ if (cdev->ports[i] == ndev) ++ found = true; ++ ++ if (!found) ++ goto free_dst; ++ + port_id = cxgb4_port_idx(ndev); + + csk = chtls_sock_create(cdev); +@@ -1108,6 +1117,7 @@ static struct sock *chtls_recv_sock(stru + free_csk: + chtls_sock_release(&csk->kref); + free_dst: ++ neigh_release(n); + dst_release(dst); + free_sk: + inet_csk_prepare_forced_close(newsk); diff --git a/queue-4.19/chtls-remove-invalid-set_tcb-call.patch b/queue-4.19/chtls-remove-invalid-set_tcb-call.patch new file mode 100644 index 00000000000..ed8e0e52417 --- /dev/null +++ b/queue-4.19/chtls-remove-invalid-set_tcb-call.patch @@ -0,0 +1,35 @@ +From foo@baz Fri Jan 15 09:43:29 AM CET 2021 +From: Ayush Sawal +Date: Wed, 6 Jan 2021 09:59:07 +0530 +Subject: chtls: Remove invalid set_tcb call + +From: Ayush Sawal + +[ Upstream commit 827d329105bfde6701f0077e34a09c4a86e27145 ] + +At the time of SYN_RECV, connection information is not +initialized at FW, updating tcb flag over uninitialized +connection causes adapter crash. We don't need to +update the flag during SYN_RECV state, so avoid this. + +Fixes: cc35c88ae4db ("crypto : chtls - CPL handler definition") +Signed-off-by: Rohit Maheshwari +Signed-off-by: Ayush Sawal +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/crypto/chelsio/chtls/chtls_cm.c | 3 --- + 1 file changed, 3 deletions(-) + +--- a/drivers/crypto/chelsio/chtls/chtls_cm.c ++++ b/drivers/crypto/chelsio/chtls/chtls_cm.c +@@ -1920,9 +1920,6 @@ static void chtls_abort_req_rss(struct s + int queue = csk->txq_idx; + + if (is_neg_adv(req->status)) { +- if (sk->sk_state == TCP_SYN_RECV) +- chtls_set_tcb_tflag(sk, 0, 0); +- + kfree_skb(skb); + return; + } diff --git a/queue-4.19/chtls-replace-skb_dequeue-with-skb_peek.patch b/queue-4.19/chtls-replace-skb_dequeue-with-skb_peek.patch new file mode 100644 index 00000000000..5dfc1224720 --- /dev/null +++ b/queue-4.19/chtls-replace-skb_dequeue-with-skb_peek.patch @@ -0,0 +1,34 @@ +From foo@baz Fri Jan 15 09:43:29 AM CET 2021 +From: Ayush Sawal +Date: Wed, 6 Jan 2021 09:59:10 +0530 +Subject: chtls: Replace skb_dequeue with skb_peek + +From: Ayush Sawal + +[ Upstream commit a84b2c0d5fa23da6d6c8c0d5f5c93184a2744d3e ] + +The skb is unlinked twice, one in __skb_dequeue in function +chtls_reset_synq() and another in cleanup_syn_rcv_conn(). +So in this patch using skb_peek() instead of __skb_dequeue(), +so that unlink will be handled only in cleanup_syn_rcv_conn(). + +Fixes: cc35c88ae4db ("crypto : chtls - CPL handler definition") +Signed-off-by: Vinay Kumar Yadav +Signed-off-by: Ayush Sawal +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/crypto/chelsio/chtls/chtls_cm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/crypto/chelsio/chtls/chtls_cm.c ++++ b/drivers/crypto/chelsio/chtls/chtls_cm.c +@@ -581,7 +581,7 @@ static void chtls_reset_synq(struct list + + while (!skb_queue_empty(&listen_ctx->synq)) { + struct chtls_sock *csk = +- container_of((struct synq *)__skb_dequeue ++ container_of((struct synq *)skb_peek + (&listen_ctx->synq), struct chtls_sock, synq); + struct sock *child = csk->sk; + diff --git a/queue-4.19/net-cdc_ncm-correct-overhead-in-delayed_ndp_size.patch b/queue-4.19/net-cdc_ncm-correct-overhead-in-delayed_ndp_size.patch new file mode 100644 index 00000000000..68410fc234e --- /dev/null +++ b/queue-4.19/net-cdc_ncm-correct-overhead-in-delayed_ndp_size.patch @@ -0,0 +1,85 @@ +From foo@baz Fri Jan 15 09:43:29 AM CET 2021 +From: "Jouni K. Seppänen" +Date: Tue, 5 Jan 2021 06:52:49 +0200 +Subject: net: cdc_ncm: correct overhead in delayed_ndp_size + +From: "Jouni K. Seppänen" + +[ Upstream commit 7a68d725e4ea384977445e0bcaed3d7de83ab5b3 ] + +Aligning to tx_ndp_modulus is not sufficient because the next align +call can be cdc_ncm_align_tail, which can add up to ctx->tx_modulus + +ctx->tx_remainder - 1 bytes. This used to lead to occasional crashes +on a Huawei 909s-120 LTE module as follows: + +- the condition marked /* if there is a remaining skb [...] */ is true + so the swaps happen +- skb_out is set from ctx->tx_curr_skb +- skb_out->len is exactly 0x3f52 +- ctx->tx_curr_size is 0x4000 and delayed_ndp_size is 0xac + (note that the sum of skb_out->len and delayed_ndp_size is 0x3ffe) +- the for loop over n is executed once +- the cdc_ncm_align_tail call marked /* align beginning of next frame */ + increases skb_out->len to 0x3f56 (the sum is now 0x4002) +- the condition marked /* check if we had enough room left [...] */ is + false so we break out of the loop +- the condition marked /* If requested, put NDP at end of frame. */ is + true so the NDP is written into skb_out +- now skb_out->len is 0x4002, so padding_count is minus two interpreted + as an unsigned number, which is used as the length argument to memset, + leading to a crash with various symptoms but usually including + +> Call Trace: +> +> cdc_ncm_fill_tx_frame+0x83a/0x970 [cdc_ncm] +> cdc_mbim_tx_fixup+0x1d9/0x240 [cdc_mbim] +> usbnet_start_xmit+0x5d/0x720 [usbnet] + +The cdc_ncm_align_tail call first aligns on a ctx->tx_modulus +boundary (adding at most ctx->tx_modulus-1 bytes), then adds +ctx->tx_remainder bytes. Alternatively, the next alignment call can +occur in cdc_ncm_ndp16 or cdc_ncm_ndp32, in which case at most +ctx->tx_ndp_modulus-1 bytes are added. + +A similar problem has occurred before, and the code is nontrivial to +reason about, so add a guard before the crashing call. By that time it +is too late to prevent any memory corruption (we'll have written past +the end of the buffer already) but we can at least try to get a warning +written into an on-disk log by avoiding the hard crash caused by padding +past the buffer with a huge number of zeros. + +Signed-off-by: Jouni K. Seppänen +Fixes: 4a0e3e989d66 ("cdc_ncm: Add support for moving NDP to end of NCM frame") +Link: https://bugzilla.kernel.org/show_bug.cgi?id=209407 +Reported-by: kernel test robot +Reviewed-by: Bjørn Mork +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/usb/cdc_ncm.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/drivers/net/usb/cdc_ncm.c ++++ b/drivers/net/usb/cdc_ncm.c +@@ -1127,7 +1127,10 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev + * accordingly. Otherwise, we should check here. + */ + if (ctx->drvflags & CDC_NCM_FLAG_NDP_TO_END) +- delayed_ndp_size = ALIGN(ctx->max_ndp_size, ctx->tx_ndp_modulus); ++ delayed_ndp_size = ctx->max_ndp_size + ++ max_t(u32, ++ ctx->tx_ndp_modulus, ++ ctx->tx_modulus + ctx->tx_remainder) - 1; + else + delayed_ndp_size = 0; + +@@ -1308,7 +1311,8 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev + if (!(dev->driver_info->flags & FLAG_SEND_ZLP) && + skb_out->len > ctx->min_tx_pkt) { + padding_count = ctx->tx_curr_size - skb_out->len; +- skb_put_zero(skb_out, padding_count); ++ if (!WARN_ON(padding_count > ctx->tx_curr_size)) ++ skb_put_zero(skb_out, padding_count); + } else if (skb_out->len < ctx->tx_curr_size && + (skb_out->len % dev->maxpacket) == 0) { + skb_put_u8(skb_out, 0); /* force short packet */ diff --git a/queue-4.19/net-fix-pmtu-check-in-nopmtudisc-mode.patch b/queue-4.19/net-fix-pmtu-check-in-nopmtudisc-mode.patch new file mode 100644 index 00000000000..14d38b02c80 --- /dev/null +++ b/queue-4.19/net-fix-pmtu-check-in-nopmtudisc-mode.patch @@ -0,0 +1,61 @@ +From foo@baz Fri Jan 15 09:43:29 AM CET 2021 +From: Florian Westphal +Date: Wed, 6 Jan 2021 00:15:22 +0100 +Subject: net: fix pmtu check in nopmtudisc mode + +From: Florian Westphal + +[ Upstream commit 50c661670f6a3908c273503dfa206dfc7aa54c07 ] + +For some reason ip_tunnel insist on setting the DF bit anyway when the +inner header has the DF bit set, EVEN if the tunnel was configured with +'nopmtudisc'. + +This means that the script added in the previous commit +cannot be made to work by adding the 'nopmtudisc' flag to the +ip tunnel configuration. Doing so breaks connectivity even for the +without-conntrack/netfilter scenario. + +When nopmtudisc is set, the tunnel will skip the mtu check, so no +icmp error is sent to client. Then, because inner header has DF set, +the outer header gets added with DF bit set as well. + +IP stack then sends an error to itself because the packet exceeds +the device MTU. + +Fixes: 23a3647bc4f93 ("ip_tunnels: Use skb-len to PMTU check.") +Cc: Stefano Brivio +Signed-off-by: Florian Westphal +Acked-by: Pablo Neira Ayuso +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/ip_tunnel.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/net/ipv4/ip_tunnel.c ++++ b/net/ipv4/ip_tunnel.c +@@ -736,7 +736,11 @@ void ip_tunnel_xmit(struct sk_buff *skb, + goto tx_error; + } + +- if (tnl_update_pmtu(dev, skb, rt, tnl_params->frag_off, inner_iph)) { ++ df = tnl_params->frag_off; ++ if (skb->protocol == htons(ETH_P_IP) && !tunnel->ignore_df) ++ df |= (inner_iph->frag_off & htons(IP_DF)); ++ ++ if (tnl_update_pmtu(dev, skb, rt, df, inner_iph)) { + ip_rt_put(rt); + goto tx_error; + } +@@ -764,10 +768,6 @@ void ip_tunnel_xmit(struct sk_buff *skb, + ttl = ip4_dst_hoplimit(&rt->dst); + } + +- df = tnl_params->frag_off; +- if (skb->protocol == htons(ETH_P_IP) && !tunnel->ignore_df) +- df |= (inner_iph->frag_off&htons(IP_DF)); +- + max_headroom = LL_RESERVED_SPACE(rt->dst.dev) + sizeof(struct iphdr) + + rt->dst.header_len + ip_encap_hlen(&tunnel->encap); + if (max_headroom > dev->needed_headroom) diff --git a/queue-4.19/net-hns3-fix-the-number-of-queues-actually-used-by-arq.patch b/queue-4.19/net-hns3-fix-the-number-of-queues-actually-used-by-arq.patch new file mode 100644 index 00000000000..069e397a242 --- /dev/null +++ b/queue-4.19/net-hns3-fix-the-number-of-queues-actually-used-by-arq.patch @@ -0,0 +1,34 @@ +From foo@baz Fri Jan 15 09:43:29 AM CET 2021 +From: Yufeng Mo +Date: Tue, 5 Jan 2021 11:37:27 +0800 +Subject: net: hns3: fix the number of queues actually used by ARQ + +From: Yufeng Mo + +[ Upstream commit 65e61e3c2a619c4d4b873885b2d5394025ed117b ] + +HCLGE_MBX_MAX_ARQ_MSG_NUM is used to apply memory for the number +of queues used by ARQ(Asynchronous Receive Queue), so the head +and tail pointers should also use this macro. + +Fixes: 07a0556a3a73 ("net: hns3: Changes to support ARQ(Asynchronous Receive Queue)") +Signed-off-by: Yufeng Mo +Signed-off-by: Huazhong Tan +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/hisilicon/hns3/hclge_mbx.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/hisilicon/hns3/hclge_mbx.h ++++ b/drivers/net/ethernet/hisilicon/hns3/hclge_mbx.h +@@ -102,7 +102,7 @@ struct hclgevf_mbx_arq_ring { + #define hclge_mbx_ring_ptr_move_crq(crq) \ + (crq->next_to_use = (crq->next_to_use + 1) % crq->desc_num) + #define hclge_mbx_tail_ptr_move_arq(arq) \ +- (arq.tail = (arq.tail + 1) % HCLGE_MBX_MAX_ARQ_MSG_SIZE) ++ (arq.tail = (arq.tail + 1) % HCLGE_MBX_MAX_ARQ_MSG_NUM) + #define hclge_mbx_head_ptr_move_arq(arq) \ +- (arq.head = (arq.head + 1) % HCLGE_MBX_MAX_ARQ_MSG_SIZE) ++ (arq.head = (arq.head + 1) % HCLGE_MBX_MAX_ARQ_MSG_NUM) + #endif diff --git a/queue-4.19/net-ip-always-refragment-ip-defragmented-packets.patch b/queue-4.19/net-ip-always-refragment-ip-defragmented-packets.patch new file mode 100644 index 00000000000..09f51310f49 --- /dev/null +++ b/queue-4.19/net-ip-always-refragment-ip-defragmented-packets.patch @@ -0,0 +1,67 @@ +From foo@baz Fri Jan 15 09:43:29 AM CET 2021 +From: Florian Westphal +Date: Wed, 6 Jan 2021 00:15:23 +0100 +Subject: net: ip: always refragment ip defragmented packets + +From: Florian Westphal + +[ Upstream commit bb4cc1a18856a73f0ff5137df0c2a31f4c50f6cf ] + +Conntrack reassembly records the largest fragment size seen in IPCB. +However, when this gets forwarded/transmitted, fragmentation will only +be forced if one of the fragmented packets had the DF bit set. + +In that case, a flag in IPCB will force fragmentation even if the +MTU is large enough. + +This should work fine, but this breaks with ip tunnels. +Consider client that sends a UDP datagram of size X to another host. + +The client fragments the datagram, so two packets, of size y and z, are +sent. DF bit is not set on any of these packets. + +Middlebox netfilter reassembles those packets back to single size-X +packet, before routing decision. + +packet-size-vs-mtu checks in ip_forward are irrelevant, because DF bit +isn't set. At output time, ip refragmentation is skipped as well +because x is still smaller than the mtu of the output device. + +If ttransmit device is an ip tunnel, the packet size increases to +x+overhead. + +Also, tunnel might be configured to force DF bit on outer header. + +In this case, packet will be dropped (exceeds MTU) and an ICMP error is +generated back to sender. + +But sender already respects the announced MTU, all the packets that +it sent did fit the announced mtu. + +Force refragmentation as per original sizes unconditionally so ip tunnel +will encapsulate the fragments instead. + +The only other solution I see is to place ip refragmentation in +the ip_tunnel code to handle this case. + +Fixes: d6b915e29f4ad ("ip_fragment: don't forward defragmented DF packet") +Reported-by: Christian Perle +Signed-off-by: Florian Westphal +Acked-by: Pablo Neira Ayuso +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/ip_output.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/ipv4/ip_output.c ++++ b/net/ipv4/ip_output.c +@@ -312,7 +312,7 @@ static int ip_finish_output(struct net * + if (skb_is_gso(skb)) + return ip_finish_output_gso(net, sk, skb, mtu); + +- if (skb->len > mtu || (IPCB(skb)->flags & IPSKB_FRAG_PMTU)) ++ if (skb->len > mtu || IPCB(skb)->frag_max_size) + return ip_fragment(net, sk, skb, mtu, ip_finish_output2); + + return ip_finish_output2(net, sk, skb); diff --git a/queue-4.19/net-ipv6-fib-flush-exceptions-when-purging-route.patch b/queue-4.19/net-ipv6-fib-flush-exceptions-when-purging-route.patch new file mode 100644 index 00000000000..1adbdc84c10 --- /dev/null +++ b/queue-4.19/net-ipv6-fib-flush-exceptions-when-purging-route.patch @@ -0,0 +1,56 @@ +From foo@baz Fri Jan 15 09:43:29 AM CET 2021 +From: Sean Tranchetti +Date: Tue, 5 Jan 2021 16:22:25 -0800 +Subject: net: ipv6: fib: flush exceptions when purging route + +From: Sean Tranchetti + +[ Upstream commit d8f5c29653c3f6995e8979be5623d263e92f6b86 ] + +Route removal is handled by two code paths. The main removal path is via +fib6_del_route() which will handle purging any PMTU exceptions from the +cache, removing all per-cpu copies of the DST entry used by the route, and +releasing the fib6_info struct. + +The second removal location is during fib6_add_rt2node() during a route +replacement operation. This path also calls fib6_purge_rt() to handle +cleaning up the per-cpu copies of the DST entries and releasing the +fib6_info associated with the older route, but it does not flush any PMTU +exceptions that the older route had. Since the older route is removed from +the tree during the replacement, we lose any way of accessing it again. + +As these lingering DSTs and the fib6_info struct are holding references to +the underlying netdevice struct as well, unregistering that device from the +kernel can never complete. + +Fixes: 2b760fcf5cfb3 ("ipv6: hook up exception table to store dst cache") +Signed-off-by: Sean Tranchetti +Reviewed-by: David Ahern +Link: https://lore.kernel.org/r/1609892546-11389-1-git-send-email-stranche@quicinc.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/ip6_fib.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +--- a/net/ipv6/ip6_fib.c ++++ b/net/ipv6/ip6_fib.c +@@ -906,6 +906,8 @@ static void fib6_purge_rt(struct fib6_in + { + struct fib6_table *table = rt->fib6_table; + ++ /* Flush all cached dst in exception table */ ++ rt6_flush_exceptions(rt); + if (rt->rt6i_pcpu) + fib6_drop_pcpu_from(rt, table); + +@@ -1756,9 +1758,6 @@ static void fib6_del_route(struct fib6_t + net->ipv6.rt6_stats->fib_rt_entries--; + net->ipv6.rt6_stats->fib_discarded_routes++; + +- /* Flush all cached dst in exception table */ +- rt6_flush_exceptions(rt); +- + /* Reset round-robin state, if necessary */ + if (rcu_access_pointer(fn->rr_ptr) == rt) + fn->rr_ptr = NULL; diff --git a/queue-4.19/net-sonic-fix-some-resource-leaks-in-error-handling-paths.patch b/queue-4.19/net-sonic-fix-some-resource-leaks-in-error-handling-paths.patch new file mode 100644 index 00000000000..0503b88e249 --- /dev/null +++ b/queue-4.19/net-sonic-fix-some-resource-leaks-in-error-handling-paths.patch @@ -0,0 +1,87 @@ +From foo@baz Fri Jan 15 09:43:29 AM CET 2021 +From: Christophe JAILLET +Date: Sun, 3 Jan 2021 11:26:26 +1100 +Subject: net/sonic: Fix some resource leaks in error handling paths + +From: Christophe JAILLET + +[ Upstream commit 0f7ba7bc46fa0b574ccacf5672991b321e028492 ] + +A call to dma_alloc_coherent() is wrapped by sonic_alloc_descriptors(). + +This is correctly freed in the remove function, but not in the error +handling path of the probe function. Fix this by adding the missing +dma_free_coherent() call. + +While at it, rename a label in order to be slightly more informative. + +Cc: Christophe JAILLET +Cc: Thomas Bogendoerfer +Cc: Chris Zankel +References: commit 10e3cc180e64 ("net/sonic: Fix a resource leak in an error handling path in 'jazz_sonic_probe()'") +Fixes: 74f2a5f0ef64 ("xtensa: Add support for the Sonic Ethernet device for the XT2000 board.") +Fixes: efcce839360f ("[PATCH] macsonic/jazzsonic network drivers update") +Signed-off-by: Christophe JAILLET +Signed-off-by: Finn Thain +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/natsemi/macsonic.c | 12 ++++++++++-- + drivers/net/ethernet/natsemi/xtsonic.c | 7 +++++-- + 2 files changed, 15 insertions(+), 4 deletions(-) + +--- a/drivers/net/ethernet/natsemi/macsonic.c ++++ b/drivers/net/ethernet/natsemi/macsonic.c +@@ -540,10 +540,14 @@ static int mac_sonic_platform_probe(stru + + err = register_netdev(dev); + if (err) +- goto out; ++ goto undo_probe; + + return 0; + ++undo_probe: ++ dma_free_coherent(lp->device, ++ SIZEOF_SONIC_DESC * SONIC_BUS_SCALE(lp->dma_bitmode), ++ lp->descriptors, lp->descriptors_laddr); + out: + free_netdev(dev); + +@@ -618,12 +622,16 @@ static int mac_sonic_nubus_probe(struct + + err = register_netdev(ndev); + if (err) +- goto out; ++ goto undo_probe; + + nubus_set_drvdata(board, ndev); + + return 0; + ++undo_probe: ++ dma_free_coherent(lp->device, ++ SIZEOF_SONIC_DESC * SONIC_BUS_SCALE(lp->dma_bitmode), ++ lp->descriptors, lp->descriptors_laddr); + out: + free_netdev(ndev); + return err; +--- a/drivers/net/ethernet/natsemi/xtsonic.c ++++ b/drivers/net/ethernet/natsemi/xtsonic.c +@@ -265,11 +265,14 @@ int xtsonic_probe(struct platform_device + sonic_msg_init(dev); + + if ((err = register_netdev(dev))) +- goto out1; ++ goto undo_probe1; + + return 0; + +-out1: ++undo_probe1: ++ dma_free_coherent(lp->device, ++ SIZEOF_SONIC_DESC * SONIC_BUS_SCALE(lp->dma_bitmode), ++ lp->descriptors, lp->descriptors_laddr); + release_region(dev->base_addr, SONIC_MEM_SIZE); + out: + free_netdev(dev); diff --git a/queue-4.19/net-stmmac-dwmac-sun8i-balance-internal-phy-power.patch b/queue-4.19/net-stmmac-dwmac-sun8i-balance-internal-phy-power.patch new file mode 100644 index 00000000000..a84fcf3f8f2 --- /dev/null +++ b/queue-4.19/net-stmmac-dwmac-sun8i-balance-internal-phy-power.patch @@ -0,0 +1,114 @@ +From foo@baz Fri Jan 15 09:43:29 AM CET 2021 +From: Samuel Holland +Date: Sun, 3 Jan 2021 05:17:43 -0600 +Subject: net: stmmac: dwmac-sun8i: Balance internal PHY power + +From: Samuel Holland + +[ Upstream commit b8239638853e3e37b287e4bd4d57b41f14c78550 ] + +sun8i_dwmac_exit calls sun8i_dwmac_unpower_internal_phy, but +sun8i_dwmac_init did not call sun8i_dwmac_power_internal_phy. This +caused PHY power to remain off after a suspend/resume cycle. Fix this by +recording if PHY power should be restored, and if so, restoring it. + +Fixes: 634db83b8265 ("net: stmmac: dwmac-sun8i: Handle integrated/external MDIOs") +Signed-off-by: Samuel Holland +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c | 31 ++++++++++++++++------ + 1 file changed, 23 insertions(+), 8 deletions(-) + +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c +@@ -73,6 +73,7 @@ struct emac_variant { + * @variant: reference to the current board variant + * @regmap: regmap for using the syscon + * @internal_phy_powered: Does the internal PHY is enabled ++ * @use_internal_phy: Is the internal PHY selected for use + * @mux_handle: Internal pointer used by mdio-mux lib + */ + struct sunxi_priv_data { +@@ -83,6 +84,7 @@ struct sunxi_priv_data { + const struct emac_variant *variant; + struct regmap_field *regmap_field; + bool internal_phy_powered; ++ bool use_internal_phy; + void *mux_handle; + }; + +@@ -518,8 +520,11 @@ static const struct stmmac_dma_ops sun8i + .dma_interrupt = sun8i_dwmac_dma_interrupt, + }; + ++static int sun8i_dwmac_power_internal_phy(struct stmmac_priv *priv); ++ + static int sun8i_dwmac_init(struct platform_device *pdev, void *priv) + { ++ struct net_device *ndev = platform_get_drvdata(pdev); + struct sunxi_priv_data *gmac = priv; + int ret; + +@@ -533,13 +538,25 @@ static int sun8i_dwmac_init(struct platf + + ret = clk_prepare_enable(gmac->tx_clk); + if (ret) { +- if (gmac->regulator) +- regulator_disable(gmac->regulator); + dev_err(&pdev->dev, "Could not enable AHB clock\n"); +- return ret; ++ goto err_disable_regulator; ++ } ++ ++ if (gmac->use_internal_phy) { ++ ret = sun8i_dwmac_power_internal_phy(netdev_priv(ndev)); ++ if (ret) ++ goto err_disable_clk; + } + + return 0; ++ ++err_disable_clk: ++ clk_disable_unprepare(gmac->tx_clk); ++err_disable_regulator: ++ if (gmac->regulator) ++ regulator_disable(gmac->regulator); ++ ++ return ret; + } + + static void sun8i_dwmac_core_init(struct mac_device_info *hw, +@@ -809,7 +826,6 @@ static int mdio_mux_syscon_switch_fn(int + struct sunxi_priv_data *gmac = priv->plat->bsp_priv; + u32 reg, val; + int ret = 0; +- bool need_power_ephy = false; + + if (current_child ^ desired_child) { + regmap_field_read(gmac->regmap_field, ®); +@@ -817,13 +833,12 @@ static int mdio_mux_syscon_switch_fn(int + case DWMAC_SUN8I_MDIO_MUX_INTERNAL_ID: + dev_info(priv->device, "Switch mux to internal PHY"); + val = (reg & ~H3_EPHY_MUX_MASK) | H3_EPHY_SELECT; +- +- need_power_ephy = true; ++ gmac->use_internal_phy = true; + break; + case DWMAC_SUN8I_MDIO_MUX_EXTERNAL_ID: + dev_info(priv->device, "Switch mux to external PHY"); + val = (reg & ~H3_EPHY_MUX_MASK) | H3_EPHY_SHUTDOWN; +- need_power_ephy = false; ++ gmac->use_internal_phy = false; + break; + default: + dev_err(priv->device, "Invalid child ID %x\n", +@@ -831,7 +846,7 @@ static int mdio_mux_syscon_switch_fn(int + return -EINVAL; + } + regmap_field_write(gmac->regmap_field, val); +- if (need_power_ephy) { ++ if (gmac->use_internal_phy) { + ret = sun8i_dwmac_power_internal_phy(priv); + if (ret) + return ret; diff --git a/queue-4.19/net-stmmac-dwmac-sun8i-balance-internal-phy-resource-references.patch b/queue-4.19/net-stmmac-dwmac-sun8i-balance-internal-phy-resource-references.patch new file mode 100644 index 00000000000..28875797e7c --- /dev/null +++ b/queue-4.19/net-stmmac-dwmac-sun8i-balance-internal-phy-resource-references.patch @@ -0,0 +1,91 @@ +From foo@baz Fri Jan 15 09:43:29 AM CET 2021 +From: Samuel Holland +Date: Sun, 3 Jan 2021 05:17:42 -0600 +Subject: net: stmmac: dwmac-sun8i: Balance internal PHY resource references + +From: Samuel Holland + +[ Upstream commit 529254216773acd5039c07aa18cf06fd1f9fccdd ] + +While stmmac_pltfr_remove calls sun8i_dwmac_exit, the sun8i_dwmac_init +and sun8i_dwmac_exit functions are also called by the stmmac_platform +suspend/resume callbacks. They may be called many times during the +device's lifetime and should not release resources used by the driver. + +Furthermore, there was no error handling in case registering the MDIO +mux failed during probe, and the EPHY clock was never released at all. + +Fix all of these issues by moving the deinitialization code to a driver +removal callback. Also ensure the EPHY is powered down before removal. + +Fixes: 634db83b8265 ("net: stmmac: dwmac-sun8i: Handle integrated/external MDIOs") +Signed-off-by: Samuel Holland +Reviewed-by: Chen-Yu Tsai +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c | 27 +++++++++++++++++----- + 1 file changed, 21 insertions(+), 6 deletions(-) + +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c +@@ -977,17 +977,12 @@ static void sun8i_dwmac_exit(struct plat + struct sunxi_priv_data *gmac = priv; + + if (gmac->variant->soc_has_internal_phy) { +- /* sun8i_dwmac_exit could be called with mdiomux uninit */ +- if (gmac->mux_handle) +- mdio_mux_uninit(gmac->mux_handle); + if (gmac->internal_phy_powered) + sun8i_dwmac_unpower_internal_phy(gmac); + } + + sun8i_dwmac_unset_syscon(gmac); + +- reset_control_put(gmac->rst_ephy); +- + clk_disable_unprepare(gmac->tx_clk); + + if (gmac->regulator) +@@ -1200,12 +1195,32 @@ static int sun8i_dwmac_probe(struct plat + + return ret; + dwmac_mux: ++ reset_control_put(gmac->rst_ephy); ++ clk_put(gmac->ephy_clk); + sun8i_dwmac_unset_syscon(gmac); + dwmac_exit: + stmmac_pltfr_remove(pdev); + return ret; + } + ++static int sun8i_dwmac_remove(struct platform_device *pdev) ++{ ++ struct net_device *ndev = platform_get_drvdata(pdev); ++ struct stmmac_priv *priv = netdev_priv(ndev); ++ struct sunxi_priv_data *gmac = priv->plat->bsp_priv; ++ ++ if (gmac->variant->soc_has_internal_phy) { ++ mdio_mux_uninit(gmac->mux_handle); ++ sun8i_dwmac_unpower_internal_phy(gmac); ++ reset_control_put(gmac->rst_ephy); ++ clk_put(gmac->ephy_clk); ++ } ++ ++ stmmac_pltfr_remove(pdev); ++ ++ return 0; ++} ++ + static const struct of_device_id sun8i_dwmac_match[] = { + { .compatible = "allwinner,sun8i-h3-emac", + .data = &emac_variant_h3 }, +@@ -1223,7 +1238,7 @@ MODULE_DEVICE_TABLE(of, sun8i_dwmac_matc + + static struct platform_driver sun8i_dwmac_driver = { + .probe = sun8i_dwmac_probe, +- .remove = stmmac_pltfr_remove, ++ .remove = sun8i_dwmac_remove, + .driver = { + .name = "dwmac-sun8i", + .pm = &stmmac_pltfr_pm_ops, diff --git a/queue-4.19/net-vlan-avoid-leaks-on-register_vlan_dev-failures.patch b/queue-4.19/net-vlan-avoid-leaks-on-register_vlan_dev-failures.patch new file mode 100644 index 00000000000..afbbf22ce19 --- /dev/null +++ b/queue-4.19/net-vlan-avoid-leaks-on-register_vlan_dev-failures.patch @@ -0,0 +1,39 @@ +From foo@baz Fri Jan 15 09:43:29 AM CET 2021 +From: Jakub Kicinski +Date: Wed, 30 Dec 2020 19:40:27 -0800 +Subject: net: vlan: avoid leaks on register_vlan_dev() failures + +From: Jakub Kicinski + +[ Upstream commit 55b7ab1178cbf41f979ff83236d3321ad35ed2ad ] + +VLAN checks for NETREG_UNINITIALIZED to distinguish between +registration failure and unregistration in progress. + +Since commit cb626bf566eb ("net-sysfs: Fix reference count leak") +registration failure may, however, result in NETREG_UNREGISTERED +as well as NETREG_UNINITIALIZED. + +This fix is similer to cebb69754f37 ("rtnetlink: Fix +memory(net_device) leak when ->newlink fails") + +Fixes: cb626bf566eb ("net-sysfs: Fix reference count leak") +Signed-off-by: Jakub Kicinski +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/8021q/vlan.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/net/8021q/vlan.c ++++ b/net/8021q/vlan.c +@@ -277,7 +277,8 @@ static int register_vlan_device(struct n + return 0; + + out_free_newdev: +- if (new_dev->reg_state == NETREG_UNINITIALIZED) ++ if (new_dev->reg_state == NETREG_UNINITIALIZED || ++ new_dev->reg_state == NETREG_UNREGISTERED) + free_netdev(new_dev); + return err; + } diff --git a/queue-4.19/series b/queue-4.19/series new file mode 100644 index 00000000000..fae411dae3d --- /dev/null +++ b/queue-4.19/series @@ -0,0 +1,15 @@ +net-cdc_ncm-correct-overhead-in-delayed_ndp_size.patch +net-hns3-fix-the-number-of-queues-actually-used-by-arq.patch +net-stmmac-dwmac-sun8i-balance-internal-phy-resource-references.patch +net-stmmac-dwmac-sun8i-balance-internal-phy-power.patch +net-vlan-avoid-leaks-on-register_vlan_dev-failures.patch +net-sonic-fix-some-resource-leaks-in-error-handling-paths.patch +net-ip-always-refragment-ip-defragmented-packets.patch +net-fix-pmtu-check-in-nopmtudisc-mode.patch +net-ipv6-fib-flush-exceptions-when-purging-route.patch +chtls-fix-hardware-tid-leak.patch +chtls-remove-invalid-set_tcb-call.patch +chtls-fix-panic-when-route-to-peer-not-configured.patch +chtls-replace-skb_dequeue-with-skb_peek.patch +chtls-added-a-check-to-avoid-null-pointer-dereference.patch +chtls-fix-chtls-resources-release-sequence.patch