From: Sasha Levin Date: Wed, 4 Oct 2023 09:28:33 +0000 (-0400) Subject: Fixes for 5.15 X-Git-Tag: v6.5.6~40 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=2eafc16e367188b2416e589d6a7bef6bda2b796f;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.15 Signed-off-by: Sasha Levin --- diff --git a/queue-5.15/i40e-fix-potential-null-pointer-dereferencing-of-pf-.patch b/queue-5.15/i40e-fix-potential-null-pointer-dereferencing-of-pf-.patch new file mode 100644 index 00000000000..b986262986b --- /dev/null +++ b/queue-5.15/i40e-fix-potential-null-pointer-dereferencing-of-pf-.patch @@ -0,0 +1,52 @@ +From bd1e559f7a546ab98a1056c2056c3b1db92f8b02 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Aug 2023 15:16:53 -0700 +Subject: i40e: fix potential NULL pointer dereferencing of pf->vf + i40e_sync_vsi_filters() + +From: Andrii Staikov + +[ Upstream commit 9525a3c38accd2e186f52443e35e633e296cc7f5 ] + +Add check for pf->vf not being NULL before dereferencing +pf->vf[vsi->vf_id] in updating VSI filter sync. +Add a similar check before dereferencing !pf->vf[vsi->vf_id].trusted +in the condition for clearing promisc mode bit. + +Fixes: c87c938f62d8 ("i40e: Add VF VLAN pruning") +Signed-off-by: Andrii Staikov +Signed-off-by: Aleksandr Loktionov +Tested-by: Rafal Romanowski +Signed-off-by: Tony Nguyen +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_main.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index 76bb1d0de8d1c..539bb69548f23 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -2595,7 +2595,7 @@ int i40e_sync_vsi_filters(struct i40e_vsi *vsi) + retval = i40e_correct_mac_vlan_filters + (vsi, &tmp_add_list, &tmp_del_list, + vlan_filters); +- else ++ else if (pf->vf) + retval = i40e_correct_vf_mac_vlan_filters + (vsi, &tmp_add_list, &tmp_del_list, + vlan_filters, pf->vf[vsi->vf_id].trusted); +@@ -2768,7 +2768,8 @@ int i40e_sync_vsi_filters(struct i40e_vsi *vsi) + } + + /* if the VF is not trusted do not do promisc */ +- if ((vsi->type == I40E_VSI_SRIOV) && !pf->vf[vsi->vf_id].trusted) { ++ if (vsi->type == I40E_VSI_SRIOV && pf->vf && ++ !pf->vf[vsi->vf_id].trusted) { + clear_bit(__I40E_VSI_OVERFLOW_PROMISC, vsi->state); + goto out; + } +-- +2.40.1 + diff --git a/queue-5.15/nvme-pci-always-return-an-err_ptr-from-nvme_pci_allo.patch b/queue-5.15/nvme-pci-always-return-an-err_ptr-from-nvme_pci_allo.patch new file mode 100644 index 00000000000..264b98548bb --- /dev/null +++ b/queue-5.15/nvme-pci-always-return-an-err_ptr-from-nvme_pci_allo.patch @@ -0,0 +1,47 @@ +From 638a6b3db7bc0c57c4da57e1fa1eb6057e1cec4d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Feb 2023 17:43:57 -0300 +Subject: nvme-pci: always return an ERR_PTR from nvme_pci_alloc_dev + +From: Irvin Cote + +[ Upstream commit dc785d69d753a3894c93afc23b91404652382ead ] + +Don't mix NULL and ERR_PTR returns. + +Fixes: 2e87570be9d2 ("nvme-pci: factor out a nvme_pci_alloc_dev helper") +Signed-off-by: Irvin Cote +Reviewed-by: Keith Busch +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/pci.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c +index e5980df2094ad..65172a654a198 100644 +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -2977,7 +2977,7 @@ static struct nvme_dev *nvme_pci_alloc_dev(struct pci_dev *pdev, + + dev = kzalloc_node(sizeof(*dev), GFP_KERNEL, node); + if (!dev) +- return NULL; ++ return ERR_PTR(-ENOMEM); + INIT_WORK(&dev->ctrl.reset_work, nvme_reset_work); + INIT_WORK(&dev->remove_work, nvme_remove_dead_ctrl_work); + mutex_init(&dev->shutdown_lock); +@@ -3022,8 +3022,8 @@ static int nvme_probe(struct pci_dev *pdev, const struct pci_device_id *id) + int result = -ENOMEM; + + dev = nvme_pci_alloc_dev(pdev, id); +- if (!dev) +- return -ENOMEM; ++ if (IS_ERR(dev)) ++ return PTR_ERR(dev); + + result = nvme_dev_map(dev); + if (result) +-- +2.40.1 + diff --git a/queue-5.15/perf-metric-return-early-if-no-cpu-pmu-table-exists.patch b/queue-5.15/perf-metric-return-early-if-no-cpu-pmu-table-exists.patch new file mode 100644 index 00000000000..5a497be056f --- /dev/null +++ b/queue-5.15/perf-metric-return-early-if-no-cpu-pmu-table-exists.patch @@ -0,0 +1,78 @@ +From af3d21ffdb5a9a838f97589d2724f307b44fc492 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Aug 2022 09:48:40 -0700 +Subject: perf metric: Return early if no CPU PMU table exists + +From: Ian Rogers + +[ Upstream commit 3f5df3ac646e21a79a421ae4037c4ef0632bcaa9 ] + +Previous behavior is to segfault if there is no CPU PMU table and a +metric is sought. To reproduce compile with NO_JEVENTS=1 then request a +metric, for example, "perf stat -M IPC true". + +Committer testing: + +Before: + + $ make -k NO_JEVENTS=1 BUILD_BPF_SKEL=1 O=/tmp/build/perf-urgent -C tools/perf install-bin + $ perf stat -M IPC true + Segmentation fault (core dumped) + $ + +After: + + $ perf stat -M IPC true + + Usage: perf stat [] [] + + -M, --metrics + monitor specified metrics or metric groups (separated by ,) + $ + +Fixes: 00facc760903be66 ("perf jevents: Switch build to use jevents.py") +Signed-off-by: Ian Rogers +Tested-by: Arnaldo Carvalho de Melo +Cc: Alexander Shishkin +Cc: Andi Kleen +Cc: Caleb Biggers +Cc: Florian Fischer +Cc: Ian Rogers +Cc: Ingo Molnar +Cc: James Clark +Cc: Jiri Olsa +Cc: John Garry +Cc: Kan Liang +Cc: Kshipra Bopardikar +Cc: Mark Rutland +Cc: Miaoqian Lin +Cc: Namhyung Kim +Cc: Perry Taylor +Cc: Peter Zijlstra +Cc: Stephane Eranian +Cc: Thomas Richter +Cc: Xing Zhengjun +Link: https://lore.kernel.org/r/20220830164846.401143-3-irogers@google.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/metricgroup.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/tools/perf/util/metricgroup.c b/tools/perf/util/metricgroup.c +index 29b747ac31c12..ee6c5582681bd 100644 +--- a/tools/perf/util/metricgroup.c ++++ b/tools/perf/util/metricgroup.c +@@ -1258,6 +1258,9 @@ int metricgroup__parse_groups(const struct option *opt, + struct evlist *perf_evlist = *(struct evlist **)opt->value; + struct pmu_events_map *map = pmu_events_map__find(); + ++ if (!table) ++ return -EINVAL; ++ + return parse_groups(perf_evlist, str, metric_no_group, + metric_no_merge, NULL, metric_events, map); + } +-- +2.40.1 + diff --git a/queue-5.15/scsi-qla2xxx-fix-null-pointer-dereference-in-target-.patch b/queue-5.15/scsi-qla2xxx-fix-null-pointer-dereference-in-target-.patch new file mode 100644 index 00000000000..3cd7d100409 --- /dev/null +++ b/queue-5.15/scsi-qla2xxx-fix-null-pointer-dereference-in-target-.patch @@ -0,0 +1,94 @@ +From aabb59b51f0aae3ba27ade0ffb25a3c9c85a84e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 May 2023 11:22:35 +0300 +Subject: scsi: qla2xxx: Fix NULL pointer dereference in target mode + +From: Gleb Chesnokov + +[ Upstream commit d54820b22e404b06b2b65877ff802cc7b31688bc ] + +When target mode is enabled, the pci_irq_get_affinity() function may return +a NULL value in qla_mapq_init_qp_cpu_map() due to the qla24xx_enable_msix() +code that handles IRQ settings for target mode. This leads to a crash due +to a NULL pointer dereference. + +This patch fixes the issue by adding a check for the NULL value returned by +pci_irq_get_affinity() and introducing a 'cpu_mapped' boolean flag to the +qla_qpair structure, ensuring that the qpair's CPU affinity is updated when +it has not been mapped to a CPU. + +Fixes: 1d201c81d4cc ("scsi: qla2xxx: Select qpair depending on which CPU post_cmd() gets called") +Signed-off-by: Gleb Chesnokov +Link: https://lore.kernel.org/r/56b416f2-4e0f-b6cf-d6d5-b7c372e3c6a2@scst.dev +Reviewed-by: Himanshu Madhani +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_def.h | 1 + + drivers/scsi/qla2xxx/qla_init.c | 3 +++ + drivers/scsi/qla2xxx/qla_inline.h | 3 +++ + drivers/scsi/qla2xxx/qla_isr.c | 3 +++ + 4 files changed, 10 insertions(+) + +diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h +index 723f9953ad701..3c876967e8b16 100644 +--- a/drivers/scsi/qla2xxx/qla_def.h ++++ b/drivers/scsi/qla2xxx/qla_def.h +@@ -3791,6 +3791,7 @@ struct qla_qpair { + uint64_t retry_term_jiff; + struct qla_tgt_counters tgt_counters; + uint16_t cpuid; ++ bool cpu_mapped; + struct qla_fw_resources fwres ____cacheline_aligned; + u32 cmd_cnt; + u32 cmd_completion_cnt; +diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c +index d259f6727cf74..b59d5b560a278 100644 +--- a/drivers/scsi/qla2xxx/qla_init.c ++++ b/drivers/scsi/qla2xxx/qla_init.c +@@ -9780,6 +9780,9 @@ struct qla_qpair *qla2xxx_create_qpair(struct scsi_qla_host *vha, int qos, + qpair->rsp->req = qpair->req; + qpair->rsp->qpair = qpair; + ++ if (!qpair->cpu_mapped) ++ qla_cpu_update(qpair, raw_smp_processor_id()); ++ + if (IS_T10_PI_CAPABLE(ha) && ql2xenabledif) { + if (ha->fw_attributes & BIT_4) + qpair->difdix_supported = 1; +diff --git a/drivers/scsi/qla2xxx/qla_inline.h b/drivers/scsi/qla2xxx/qla_inline.h +index e66441355f7ae..a4a56ab0ba747 100644 +--- a/drivers/scsi/qla2xxx/qla_inline.h ++++ b/drivers/scsi/qla2xxx/qla_inline.h +@@ -597,11 +597,14 @@ qla_mapq_init_qp_cpu_map(struct qla_hw_data *ha, + if (!ha->qp_cpu_map) + return; + mask = pci_irq_get_affinity(ha->pdev, msix->vector_base0); ++ if (!mask) ++ return; + qpair->cpuid = cpumask_first(mask); + for_each_cpu(cpu, mask) { + ha->qp_cpu_map[cpu] = qpair; + } + msix->cpuid = qpair->cpuid; ++ qpair->cpu_mapped = true; + } + + static inline void +diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c +index 4f6aab2599350..51e906fa8694e 100644 +--- a/drivers/scsi/qla2xxx/qla_isr.c ++++ b/drivers/scsi/qla2xxx/qla_isr.c +@@ -3782,6 +3782,9 @@ void qla24xx_process_response_queue(struct scsi_qla_host *vha, + + if (rsp->qpair->cpuid != raw_smp_processor_id() || !rsp->qpair->rcv_intr) { + rsp->qpair->rcv_intr = 1; ++ ++ if (!rsp->qpair->cpu_mapped) ++ qla_cpu_update(rsp->qpair, raw_smp_processor_id()); + } + + #define __update_rsp_in(_update, _is_shadow_hba, _rsp, _rsp_in) \ +-- +2.40.1 + diff --git a/queue-5.15/series b/queue-5.15/series index c0e1dd5864f..e9560ee192a 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -147,3 +147,7 @@ nvme-pci-factor-out-a-nvme_pci_alloc_dev-helper.patch nvme-pci-do-not-set-the-numa-node-of-device-if-it-ha.patch watchdog-itco_wdt-no-need-to-stop-the-timer-in-probe.patch watchdog-itco_wdt-set-no_reboot-if-the-watchdog-is-n.patch +i40e-fix-potential-null-pointer-dereferencing-of-pf-.patch +perf-metric-return-early-if-no-cpu-pmu-table-exists.patch +scsi-qla2xxx-fix-null-pointer-dereference-in-target-.patch +nvme-pci-always-return-an-err_ptr-from-nvme_pci_allo.patch