From: Greg Kroah-Hartman Date: Fri, 30 Aug 2024 10:37:42 +0000 (+0200) Subject: 6.1-stable patches X-Git-Tag: v4.19.321~71 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=3868d544d7898180cdf06a12b9a2c234ad843641;p=thirdparty%2Fkernel%2Fstable-queue.git 6.1-stable patches added patches: drm-amdgpu-align-pp_power_profile_mode-with-kernel-docs.patch drm-amdgpu-swsmu-always-force-a-state-reprogram-on-init.patch mptcp-close-subflow-when-receiving-tcp-fin.patch mptcp-pm-add_addr-0-is-not-a-new-address.patch mptcp-pm-do-not-remove-already-closed-subflows.patch mptcp-pm-reset-mpc-endp-id-when-re-added.patch mptcp-pm-send-ack-on-an-active-subflow.patch mptcp-pm-skip-connecting-to-already-established-sf.patch mptcp-sched-check-both-backup-in-retrans.patch net-mana-fix-race-of-mana_hwc_post_rx_wqe-and-new-hwc-response.patch wifi-mwifiex-duplicate-static-structs-used-in-driver-instances.patch wifi-wfx-repair-open-network-ap-mode.patch --- diff --git a/queue-6.1/drm-amdgpu-align-pp_power_profile_mode-with-kernel-docs.patch b/queue-6.1/drm-amdgpu-align-pp_power_profile_mode-with-kernel-docs.patch new file mode 100644 index 00000000000..437c444673e --- /dev/null +++ b/queue-6.1/drm-amdgpu-align-pp_power_profile_mode-with-kernel-docs.patch @@ -0,0 +1,44 @@ +From 8f614469de248a4bc55fb07e55d5f4c340c75b11 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Wed, 21 Aug 2024 14:32:02 -0400 +Subject: drm/amdgpu: align pp_power_profile_mode with kernel docs + +From: Alex Deucher + +commit 8f614469de248a4bc55fb07e55d5f4c340c75b11 upstream. + +The kernel doc says you need to select manual mode to +adjust this, but the code only allows you to adjust it when +manual mode is not selected. Remove the manual mode check. + +Reviewed-by: Kenneth Feng +Signed-off-by: Alex Deucher +(cherry picked from commit bbb05f8a9cd87f5046d05a0c596fddfb714ee457) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +--- a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c +@@ -1870,8 +1870,7 @@ static int smu_adjust_power_state_dynami + smu_dpm_ctx->dpm_level = level; + } + +- if (smu_dpm_ctx->dpm_level != AMD_DPM_FORCED_LEVEL_MANUAL && +- smu_dpm_ctx->dpm_level != AMD_DPM_FORCED_LEVEL_PERF_DETERMINISM) { ++ if (smu_dpm_ctx->dpm_level != AMD_DPM_FORCED_LEVEL_PERF_DETERMINISM) { + index = fls(smu->workload_mask); + index = index > 0 && index <= WORKLOAD_POLICY_MAX ? index - 1 : 0; + workload[0] = smu->workload_setting[index]; +@@ -1948,8 +1947,7 @@ static int smu_switch_power_profile(void + workload[0] = smu->workload_setting[index]; + } + +- if (smu_dpm_ctx->dpm_level != AMD_DPM_FORCED_LEVEL_MANUAL && +- smu_dpm_ctx->dpm_level != AMD_DPM_FORCED_LEVEL_PERF_DETERMINISM) ++ if (smu_dpm_ctx->dpm_level != AMD_DPM_FORCED_LEVEL_PERF_DETERMINISM) + smu_bump_power_profile_mode(smu, workload, 0); + + return 0; diff --git a/queue-6.1/drm-amdgpu-swsmu-always-force-a-state-reprogram-on-init.patch b/queue-6.1/drm-amdgpu-swsmu-always-force-a-state-reprogram-on-init.patch new file mode 100644 index 00000000000..c3a7324d5c2 --- /dev/null +++ b/queue-6.1/drm-amdgpu-swsmu-always-force-a-state-reprogram-on-init.patch @@ -0,0 +1,71 @@ +From d420c857d85777663e8d16adfc24463f5d5c2dbc Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Thu, 22 Aug 2024 21:54:24 -0400 +Subject: drm/amdgpu/swsmu: always force a state reprogram on init + +From: Alex Deucher + +commit d420c857d85777663e8d16adfc24463f5d5c2dbc upstream. + +Always reprogram the hardware state on init. This ensures +the PMFW state is explicitly programmed and we are not relying +on the default PMFW state. + +Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3131 +Reviewed-by: Kenneth Feng +Signed-off-by: Alex Deucher +(cherry picked from commit c50fe289ed7207f71df3b5f1720512a9620e84fb) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 15 +++++++++------ + 1 file changed, 9 insertions(+), 6 deletions(-) + +--- a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c +@@ -1829,8 +1829,9 @@ static int smu_bump_power_profile_mode(s + } + + static int smu_adjust_power_state_dynamic(struct smu_context *smu, +- enum amd_dpm_forced_level level, +- bool skip_display_settings) ++ enum amd_dpm_forced_level level, ++ bool skip_display_settings, ++ bool force_update) + { + int ret = 0; + int index = 0; +@@ -1859,7 +1860,7 @@ static int smu_adjust_power_state_dynami + } + } + +- if (smu_dpm_ctx->dpm_level != level) { ++ if (force_update || smu_dpm_ctx->dpm_level != level) { + ret = smu_asic_set_performance_level(smu, level); + if (ret) { + dev_err(smu->adev->dev, "Failed to set performance level!"); +@@ -1875,7 +1876,7 @@ static int smu_adjust_power_state_dynami + index = index > 0 && index <= WORKLOAD_POLICY_MAX ? index - 1 : 0; + workload[0] = smu->workload_setting[index]; + +- if (smu->power_profile_mode != workload[0]) ++ if (force_update || smu->power_profile_mode != workload[0]) + smu_bump_power_profile_mode(smu, workload, 0); + } + +@@ -1896,11 +1897,13 @@ static int smu_handle_task(struct smu_co + ret = smu_pre_display_config_changed(smu); + if (ret) + return ret; +- ret = smu_adjust_power_state_dynamic(smu, level, false); ++ ret = smu_adjust_power_state_dynamic(smu, level, false, false); + break; + case AMD_PP_TASK_COMPLETE_INIT: ++ ret = smu_adjust_power_state_dynamic(smu, level, true, true); ++ break; + case AMD_PP_TASK_READJUST_POWER_STATE: +- ret = smu_adjust_power_state_dynamic(smu, level, true); ++ ret = smu_adjust_power_state_dynamic(smu, level, true, false); + break; + default: + break; diff --git a/queue-6.1/mptcp-close-subflow-when-receiving-tcp-fin.patch b/queue-6.1/mptcp-close-subflow-when-receiving-tcp-fin.patch new file mode 100644 index 00000000000..03f9c526982 --- /dev/null +++ b/queue-6.1/mptcp-close-subflow-when-receiving-tcp-fin.patch @@ -0,0 +1,81 @@ +From f09b0ad55a1196f5891663f8888463c0541059cb Mon Sep 17 00:00:00 2001 +From: "Matthieu Baerts (NGI0)" +Date: Mon, 26 Aug 2024 19:11:18 +0200 +Subject: mptcp: close subflow when receiving TCP+FIN + +From: Matthieu Baerts (NGI0) + +commit f09b0ad55a1196f5891663f8888463c0541059cb upstream. + +When a peer decides to close one subflow in the middle of a connection +having multiple subflows, the receiver of the first FIN should accept +that, and close the subflow on its side as well. If not, the subflow +will stay half closed, and would even continue to be used until the end +of the MPTCP connection or a reset from the network. + +The issue has not been seen before, probably because the in-kernel +path-manager always sends a RM_ADDR before closing the subflow. Upon the +reception of this RM_ADDR, the other peer will initiate the closure on +its side as well. On the other hand, if the RM_ADDR is lost, or if the +path-manager of the other peer only closes the subflow without sending a +RM_ADDR, the subflow would switch to TCP_CLOSE_WAIT, but that's it, +leaving the subflow half-closed. + +So now, when the subflow switches to the TCP_CLOSE_WAIT state, and if +the MPTCP connection has not been closed before with a DATA_FIN, the +kernel owning the subflow schedules its worker to initiate the closure +on its side as well. + +This issue can be easily reproduced with packetdrill, as visible in [1], +by creating an additional subflow, injecting a FIN+ACK before sending +the DATA_FIN, and expecting a FIN+ACK in return. + +Fixes: 40947e13997a ("mptcp: schedule worker when subflow is closed") +Cc: stable@vger.kernel.org +Link: https://github.com/multipath-tcp/packetdrill/pull/154 [1] +Reviewed-by: Mat Martineau +Signed-off-by: Matthieu Baerts (NGI0) +Link: https://patch.msgid.link/20240826-net-mptcp-close-extra-sf-fin-v1-1-905199fe1172@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/mptcp/protocol.c | 5 ++++- + net/mptcp/subflow.c | 8 ++++++-- + 2 files changed, 10 insertions(+), 3 deletions(-) + +--- a/net/mptcp/protocol.c ++++ b/net/mptcp/protocol.c +@@ -2528,8 +2528,11 @@ static void __mptcp_close_subflow(struct + + mptcp_for_each_subflow_safe(msk, subflow, tmp) { + struct sock *ssk = mptcp_subflow_tcp_sock(subflow); ++ int ssk_state = inet_sk_state_load(ssk); + +- if (inet_sk_state_load(ssk) != TCP_CLOSE) ++ if (ssk_state != TCP_CLOSE && ++ (ssk_state != TCP_CLOSE_WAIT || ++ inet_sk_state_load(sk) != TCP_ESTABLISHED)) + continue; + + /* 'subflow_data_ready' will re-sched once rx queue is empty */ +--- a/net/mptcp/subflow.c ++++ b/net/mptcp/subflow.c +@@ -1137,12 +1137,16 @@ out: + /* sched mptcp worker to remove the subflow if no more data is pending */ + static void subflow_sched_work_if_closed(struct mptcp_sock *msk, struct sock *ssk) + { +- if (likely(ssk->sk_state != TCP_CLOSE)) ++ struct sock *sk = (struct sock *)msk; ++ ++ if (likely(ssk->sk_state != TCP_CLOSE && ++ (ssk->sk_state != TCP_CLOSE_WAIT || ++ inet_sk_state_load(sk) != TCP_ESTABLISHED))) + return; + + if (skb_queue_empty(&ssk->sk_receive_queue) && + !test_and_set_bit(MPTCP_WORK_CLOSE_SUBFLOW, &msk->flags)) +- mptcp_schedule_work((struct sock *)msk); ++ mptcp_schedule_work(sk); + } + + static bool subflow_can_fallback(struct mptcp_subflow_context *subflow) diff --git a/queue-6.1/mptcp-pm-add_addr-0-is-not-a-new-address.patch b/queue-6.1/mptcp-pm-add_addr-0-is-not-a-new-address.patch new file mode 100644 index 00000000000..8ede52bd4ce --- /dev/null +++ b/queue-6.1/mptcp-pm-add_addr-0-is-not-a-new-address.patch @@ -0,0 +1,80 @@ +From 57f86203b41c98b322119dfdbb1ec54ce5e3369b Mon Sep 17 00:00:00 2001 +From: "Matthieu Baerts (NGI0)" +Date: Wed, 28 Aug 2024 08:14:37 +0200 +Subject: mptcp: pm: ADD_ADDR 0 is not a new address + +From: Matthieu Baerts (NGI0) + +commit 57f86203b41c98b322119dfdbb1ec54ce5e3369b upstream. + +The ADD_ADDR 0 with the address from the initial subflow should not be +considered as a new address: this is not something new. If the host +receives it, it simply means that the address is available again. + +When receiving an ADD_ADDR for the ID 0, the PM already doesn't consider +it as new by not incrementing the 'add_addr_accepted' counter. But the +'accept_addr' might not be set if the limit has already been reached: +this can be bypassed in this case. But before, it is important to check +that this ADD_ADDR for the ID 0 is for the same address as the initial +subflow. If not, it is not something that should happen, and the +ADD_ADDR can be ignored. + +Note that if an ADD_ADDR is received while there is already a subflow +opened using the same address, this ADD_ADDR is ignored as well. It +means that if multiple ADD_ADDR for ID 0 are received, there will not be +any duplicated subflows created by the client. + +Fixes: d0876b2284cf ("mptcp: add the incoming RM_ADDR support") +Cc: stable@vger.kernel.org +Reviewed-by: Mat Martineau +Signed-off-by: Matthieu Baerts (NGI0) +Signed-off-by: Paolo Abeni +Signed-off-by: Greg Kroah-Hartman +--- + net/mptcp/pm.c | 4 +++- + net/mptcp/pm_netlink.c | 9 +++++++++ + net/mptcp/protocol.h | 2 ++ + 3 files changed, 14 insertions(+), 1 deletion(-) + +--- a/net/mptcp/pm.c ++++ b/net/mptcp/pm.c +@@ -235,7 +235,9 @@ void mptcp_pm_add_addr_received(const st + } else { + __MPTCP_INC_STATS(sock_net((struct sock *)msk), MPTCP_MIB_ADDADDRDROP); + } +- } else if (!READ_ONCE(pm->accept_addr)) { ++ /* id0 should not have a different address */ ++ } else if ((addr->id == 0 && !mptcp_pm_nl_is_init_remote_addr(msk, addr)) || ++ (addr->id > 0 && !READ_ONCE(pm->accept_addr))) { + mptcp_pm_announce_addr(msk, addr, true); + mptcp_pm_add_addr_send_ack(msk); + } else if (mptcp_pm_schedule_work(msk, MPTCP_PM_ADD_ADDR_RECEIVED)) { +--- a/net/mptcp/pm_netlink.c ++++ b/net/mptcp/pm_netlink.c +@@ -739,6 +739,15 @@ static void mptcp_pm_nl_add_addr_receive + } + } + ++bool mptcp_pm_nl_is_init_remote_addr(struct mptcp_sock *msk, ++ const struct mptcp_addr_info *remote) ++{ ++ struct mptcp_addr_info mpc_remote; ++ ++ remote_address((struct sock_common *)msk, &mpc_remote); ++ return mptcp_addresses_equal(&mpc_remote, remote, remote->port); ++} ++ + void mptcp_pm_nl_addr_send_ack(struct mptcp_sock *msk) + { + struct mptcp_subflow_context *subflow; +--- a/net/mptcp/protocol.h ++++ b/net/mptcp/protocol.h +@@ -802,6 +802,8 @@ void mptcp_pm_add_addr_received(const st + void mptcp_pm_add_addr_echoed(struct mptcp_sock *msk, + const struct mptcp_addr_info *addr); + void mptcp_pm_add_addr_send_ack(struct mptcp_sock *msk); ++bool mptcp_pm_nl_is_init_remote_addr(struct mptcp_sock *msk, ++ const struct mptcp_addr_info *remote); + void mptcp_pm_nl_addr_send_ack(struct mptcp_sock *msk); + void mptcp_pm_rm_addr_received(struct mptcp_sock *msk, + const struct mptcp_rm_list *rm_list); diff --git a/queue-6.1/mptcp-pm-do-not-remove-already-closed-subflows.patch b/queue-6.1/mptcp-pm-do-not-remove-already-closed-subflows.patch new file mode 100644 index 00000000000..3260a039ba0 --- /dev/null +++ b/queue-6.1/mptcp-pm-do-not-remove-already-closed-subflows.patch @@ -0,0 +1,34 @@ +From 58e1b66b4e4b8a602d3f2843e8eba00a969ecce2 Mon Sep 17 00:00:00 2001 +From: "Matthieu Baerts (NGI0)" +Date: Wed, 28 Aug 2024 08:14:32 +0200 +Subject: mptcp: pm: do not remove already closed subflows + +From: Matthieu Baerts (NGI0) + +commit 58e1b66b4e4b8a602d3f2843e8eba00a969ecce2 upstream. + +It is possible to have in the list already closed subflows, e.g. the +initial subflow has been already closed, but still in the list. No need +to try to close it again, and increments the related counters again. + +Fixes: 0ee4261a3681 ("mptcp: implement mptcp_pm_remove_subflow") +Cc: stable@vger.kernel.org +Reviewed-by: Mat Martineau +Signed-off-by: Matthieu Baerts (NGI0) +Signed-off-by: Paolo Abeni +Signed-off-by: Greg Kroah-Hartman +--- + net/mptcp/pm_netlink.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/net/mptcp/pm_netlink.c ++++ b/net/mptcp/pm_netlink.c +@@ -825,6 +825,8 @@ static void mptcp_pm_nl_rm_addr_or_subfl + int how = RCV_SHUTDOWN | SEND_SHUTDOWN; + u8 id = subflow_get_local_id(subflow); + ++ if (inet_sk_state_load(ssk) == TCP_CLOSE) ++ continue; + if (rm_type == MPTCP_MIB_RMADDR && remote_id != rm_id) + continue; + if (rm_type == MPTCP_MIB_RMSUBFLOW && !mptcp_local_id_match(msk, id, rm_id)) diff --git a/queue-6.1/mptcp-pm-reset-mpc-endp-id-when-re-added.patch b/queue-6.1/mptcp-pm-reset-mpc-endp-id-when-re-added.patch new file mode 100644 index 00000000000..d3f30125ce6 --- /dev/null +++ b/queue-6.1/mptcp-pm-reset-mpc-endp-id-when-re-added.patch @@ -0,0 +1,82 @@ +From dce1c6d1e92535f165219695a826caedcca4e9b9 Mon Sep 17 00:00:00 2001 +From: "Matthieu Baerts (NGI0)" +Date: Wed, 28 Aug 2024 08:14:29 +0200 +Subject: mptcp: pm: reset MPC endp ID when re-added + +From: Matthieu Baerts (NGI0) + +commit dce1c6d1e92535f165219695a826caedcca4e9b9 upstream. + +The initial subflow has a special local ID: 0. It is specific per +connection. + +When a global endpoint is deleted and re-added later, it can have a +different ID -- most services managing the endpoints automatically don't +force the ID to be the same as before. It is then important to track +these modifications to be consistent with the ID being used for the +address used by the initial subflow, not to confuse the other peer or to +send the ID 0 for the wrong address. + +Now when removing an endpoint, msk->mpc_endpoint_id is reset if it +corresponds to this endpoint. When adding a new endpoint, the same +variable is updated if the address match the one of the initial subflow. + +Fixes: 3ad14f54bd74 ("mptcp: more accurate MPC endpoint tracking") +Cc: stable@vger.kernel.org +Reviewed-by: Mat Martineau +Signed-off-by: Matthieu Baerts (NGI0) +Signed-off-by: Paolo Abeni +Signed-off-by: Greg Kroah-Hartman +--- + net/mptcp/pm_netlink.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +--- a/net/mptcp/pm_netlink.c ++++ b/net/mptcp/pm_netlink.c +@@ -1331,20 +1331,27 @@ static struct pm_nl_pernet *genl_info_pm + return pm_nl_get_pernet(genl_info_net(info)); + } + +-static int mptcp_nl_add_subflow_or_signal_addr(struct net *net) ++static int mptcp_nl_add_subflow_or_signal_addr(struct net *net, ++ struct mptcp_addr_info *addr) + { + struct mptcp_sock *msk; + long s_slot = 0, s_num = 0; + + while ((msk = mptcp_token_iter_next(net, &s_slot, &s_num)) != NULL) { + struct sock *sk = (struct sock *)msk; ++ struct mptcp_addr_info mpc_addr; + + if (!READ_ONCE(msk->fully_established) || + mptcp_pm_is_userspace(msk)) + goto next; + ++ /* if the endp linked to the init sf is re-added with a != ID */ ++ mptcp_local_address((struct sock_common *)msk, &mpc_addr); ++ + lock_sock(sk); + spin_lock_bh(&msk->pm.lock); ++ if (mptcp_addresses_equal(addr, &mpc_addr, addr->port)) ++ msk->mpc_endpoint_id = addr->id; + mptcp_pm_create_subflow_or_signal_addr(msk); + spin_unlock_bh(&msk->pm.lock); + release_sock(sk); +@@ -1417,7 +1424,7 @@ static int mptcp_nl_cmd_add_addr(struct + goto out_free; + } + +- mptcp_nl_add_subflow_or_signal_addr(sock_net(skb->sk)); ++ mptcp_nl_add_subflow_or_signal_addr(sock_net(skb->sk), &entry->addr); + return 0; + + out_free: +@@ -1530,6 +1537,8 @@ static int mptcp_nl_remove_subflow_and_s + spin_unlock_bh(&msk->pm.lock); + } + ++ if (msk->mpc_endpoint_id == entry->addr.id) ++ msk->mpc_endpoint_id = 0; + release_sock(sk); + + next: diff --git a/queue-6.1/mptcp-pm-send-ack-on-an-active-subflow.patch b/queue-6.1/mptcp-pm-send-ack-on-an-active-subflow.patch new file mode 100644 index 00000000000..71b4c374c3c --- /dev/null +++ b/queue-6.1/mptcp-pm-send-ack-on-an-active-subflow.patch @@ -0,0 +1,41 @@ +From c07cc3ed895f9bfe0c53b5ed6be710c133b4271c Mon Sep 17 00:00:00 2001 +From: "Matthieu Baerts (NGI0)" +Date: Wed, 28 Aug 2024 08:14:27 +0200 +Subject: mptcp: pm: send ACK on an active subflow + +From: Matthieu Baerts (NGI0) + +commit c07cc3ed895f9bfe0c53b5ed6be710c133b4271c upstream. + +Taking the first one on the list doesn't work in some cases, e.g. if the +initial subflow is being removed. Pick another one instead of not +sending anything. + +Fixes: 84dfe3677a6f ("mptcp: send out dedicated ADD_ADDR packet") +Cc: stable@vger.kernel.org +Reviewed-by: Mat Martineau +Signed-off-by: Matthieu Baerts (NGI0) +Signed-off-by: Paolo Abeni +Signed-off-by: Greg Kroah-Hartman +--- + net/mptcp/pm_netlink.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/net/mptcp/pm_netlink.c ++++ b/net/mptcp/pm_netlink.c +@@ -750,9 +750,12 @@ void mptcp_pm_nl_addr_send_ack(struct mp + !mptcp_pm_should_rm_signal(msk)) + return; + +- subflow = list_first_entry_or_null(&msk->conn_list, typeof(*subflow), node); +- if (subflow) +- mptcp_pm_send_ack(msk, subflow, false, false); ++ mptcp_for_each_subflow(msk, subflow) { ++ if (__mptcp_subflow_active(subflow)) { ++ mptcp_pm_send_ack(msk, subflow, false, false); ++ break; ++ } ++ } + } + + int mptcp_pm_nl_mp_prio_send_ack(struct mptcp_sock *msk, diff --git a/queue-6.1/mptcp-pm-skip-connecting-to-already-established-sf.patch b/queue-6.1/mptcp-pm-skip-connecting-to-already-established-sf.patch new file mode 100644 index 00000000000..518e0fc55bc --- /dev/null +++ b/queue-6.1/mptcp-pm-skip-connecting-to-already-established-sf.patch @@ -0,0 +1,54 @@ +From bc19ff57637ff563d2bdf2b385b48c41e6509e0d Mon Sep 17 00:00:00 2001 +From: "Matthieu Baerts (NGI0)" +Date: Wed, 28 Aug 2024 08:14:28 +0200 +Subject: mptcp: pm: skip connecting to already established sf + +From: Matthieu Baerts (NGI0) + +commit bc19ff57637ff563d2bdf2b385b48c41e6509e0d upstream. + +The lookup_subflow_by_daddr() helper checks if there is already a +subflow connected to this address. But there could be a subflow that is +closing, but taking time due to some reasons: latency, losses, data to +process, etc. + +If an ADD_ADDR is received while the endpoint is being closed, it is +better to try connecting to it, instead of rejecting it: the peer which +has sent the ADD_ADDR will not be notified that the ADD_ADDR has been +rejected for this reason, and the expected subflow will not be created +at the end. + +This helper should then only look for subflows that are established, or +going to be, but not the ones being closed. + +Fixes: d84ad04941c3 ("mptcp: skip connecting the connected address") +Cc: stable@vger.kernel.org +Reviewed-by: Mat Martineau +Signed-off-by: Matthieu Baerts (NGI0) +Signed-off-by: Paolo Abeni +Signed-off-by: Greg Kroah-Hartman +--- + net/mptcp/pm_netlink.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/net/mptcp/pm_netlink.c ++++ b/net/mptcp/pm_netlink.c +@@ -134,12 +134,15 @@ static bool lookup_subflow_by_daddr(cons + { + struct mptcp_subflow_context *subflow; + struct mptcp_addr_info cur; +- struct sock_common *skc; + + list_for_each_entry(subflow, list, node) { +- skc = (struct sock_common *)mptcp_subflow_tcp_sock(subflow); ++ struct sock *ssk = mptcp_subflow_tcp_sock(subflow); + +- remote_address(skc, &cur); ++ if (!((1 << inet_sk_state_load(ssk)) & ++ (TCPF_ESTABLISHED | TCPF_SYN_SENT | TCPF_SYN_RECV))) ++ continue; ++ ++ remote_address((struct sock_common *)ssk, &cur); + if (mptcp_addresses_equal(&cur, daddr, daddr->port)) + return true; + } diff --git a/queue-6.1/mptcp-sched-check-both-backup-in-retrans.patch b/queue-6.1/mptcp-sched-check-both-backup-in-retrans.patch new file mode 100644 index 00000000000..d9ea4150541 --- /dev/null +++ b/queue-6.1/mptcp-sched-check-both-backup-in-retrans.patch @@ -0,0 +1,48 @@ +From 2a1f596ebb23eadc0f9b95a8012e18ef76295fc8 Mon Sep 17 00:00:00 2001 +From: "Matthieu Baerts (NGI0)" +Date: Mon, 26 Aug 2024 19:11:20 +0200 +Subject: mptcp: sched: check both backup in retrans + +From: Matthieu Baerts (NGI0) + +commit 2a1f596ebb23eadc0f9b95a8012e18ef76295fc8 upstream. + +The 'mptcp_subflow_context' structure has two items related to the +backup flags: + + - 'backup': the subflow has been marked as backup by the other peer + + - 'request_bkup': the backup flag has been set by the host + +Looking only at the 'backup' flag can make sense in some cases, but it +is not the behaviour of the default packet scheduler when selecting +paths. + +As explained in the commit b6a66e521a20 ("mptcp: sched: check both +directions for backup"), the packet scheduler should look at both flags, +because that was the behaviour from the beginning: the 'backup' flag was +set by accident instead of the 'request_bkup' one. Now that the latter +has been fixed, get_retrans() needs to be adapted as well. + +Fixes: b6a66e521a20 ("mptcp: sched: check both directions for backup") +Cc: stable@vger.kernel.org +Reviewed-by: Mat Martineau +Signed-off-by: Matthieu Baerts (NGI0) +Link: https://patch.msgid.link/20240826-net-mptcp-close-extra-sf-fin-v1-3-905199fe1172@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/mptcp/protocol.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/mptcp/protocol.c ++++ b/net/mptcp/protocol.c +@@ -2309,7 +2309,7 @@ static struct sock *mptcp_subflow_get_re + continue; + } + +- if (subflow->backup) { ++ if (subflow->backup || subflow->request_bkup) { + if (!backup) + backup = ssk; + continue; diff --git a/queue-6.1/net-mana-fix-race-of-mana_hwc_post_rx_wqe-and-new-hwc-response.patch b/queue-6.1/net-mana-fix-race-of-mana_hwc_post_rx_wqe-and-new-hwc-response.patch new file mode 100644 index 00000000000..91f388606c4 --- /dev/null +++ b/queue-6.1/net-mana-fix-race-of-mana_hwc_post_rx_wqe-and-new-hwc-response.patch @@ -0,0 +1,133 @@ +From 8af174ea863c72f25ce31cee3baad8a301c0cf0f Mon Sep 17 00:00:00 2001 +From: Haiyang Zhang +Date: Wed, 21 Aug 2024 13:42:29 -0700 +Subject: net: mana: Fix race of mana_hwc_post_rx_wqe and new hwc response + +From: Haiyang Zhang + +commit 8af174ea863c72f25ce31cee3baad8a301c0cf0f upstream. + +The mana_hwc_rx_event_handler() / mana_hwc_handle_resp() calls +complete(&ctx->comp_event) before posting the wqe back. It's +possible that other callers, like mana_create_txq(), start the +next round of mana_hwc_send_request() before the posting of wqe. +And if the HW is fast enough to respond, it can hit no_wqe error +on the HW channel, then the response message is lost. The mana +driver may fail to create queues and open, because of waiting for +the HW response and timed out. +Sample dmesg: +[ 528.610840] mana 39d4:00:02.0: HWC: Request timed out! +[ 528.614452] mana 39d4:00:02.0: Failed to send mana message: -110, 0x0 +[ 528.618326] mana 39d4:00:02.0 enP14804s2: Failed to create WQ object: -110 + +To fix it, move posting of rx wqe before complete(&ctx->comp_event). + +Cc: stable@vger.kernel.org +Fixes: ca9c54d2d6a5 ("net: mana: Add a driver for Microsoft Azure Network Adapter (MANA)") +Signed-off-by: Haiyang Zhang +Reviewed-by: Long Li +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/microsoft/mana/hw_channel.c | 62 ++++++++++++----------- + 1 file changed, 34 insertions(+), 28 deletions(-) + +--- a/drivers/net/ethernet/microsoft/mana/hw_channel.c ++++ b/drivers/net/ethernet/microsoft/mana/hw_channel.c +@@ -51,9 +51,33 @@ static int mana_hwc_verify_resp_msg(cons + return 0; + } + ++static int mana_hwc_post_rx_wqe(const struct hwc_wq *hwc_rxq, ++ struct hwc_work_request *req) ++{ ++ struct device *dev = hwc_rxq->hwc->dev; ++ struct gdma_sge *sge; ++ int err; ++ ++ sge = &req->sge; ++ sge->address = (u64)req->buf_sge_addr; ++ sge->mem_key = hwc_rxq->msg_buf->gpa_mkey; ++ sge->size = req->buf_len; ++ ++ memset(&req->wqe_req, 0, sizeof(struct gdma_wqe_request)); ++ req->wqe_req.sgl = sge; ++ req->wqe_req.num_sge = 1; ++ req->wqe_req.client_data_unit = 0; ++ ++ err = mana_gd_post_and_ring(hwc_rxq->gdma_wq, &req->wqe_req, NULL); ++ if (err) ++ dev_err(dev, "Failed to post WQE on HWC RQ: %d\n", err); ++ return err; ++} ++ + static void mana_hwc_handle_resp(struct hw_channel_context *hwc, u32 resp_len, +- const struct gdma_resp_hdr *resp_msg) ++ struct hwc_work_request *rx_req) + { ++ const struct gdma_resp_hdr *resp_msg = rx_req->buf_va; + struct hwc_caller_ctx *ctx; + int err; + +@@ -61,6 +85,7 @@ static void mana_hwc_handle_resp(struct + hwc->inflight_msg_res.map)) { + dev_err(hwc->dev, "hwc_rx: invalid msg_id = %u\n", + resp_msg->response.hwc_msg_id); ++ mana_hwc_post_rx_wqe(hwc->rxq, rx_req); + return; + } + +@@ -74,30 +99,13 @@ static void mana_hwc_handle_resp(struct + memcpy(ctx->output_buf, resp_msg, resp_len); + out: + ctx->error = err; +- complete(&ctx->comp_event); +-} +- +-static int mana_hwc_post_rx_wqe(const struct hwc_wq *hwc_rxq, +- struct hwc_work_request *req) +-{ +- struct device *dev = hwc_rxq->hwc->dev; +- struct gdma_sge *sge; +- int err; +- +- sge = &req->sge; +- sge->address = (u64)req->buf_sge_addr; +- sge->mem_key = hwc_rxq->msg_buf->gpa_mkey; +- sge->size = req->buf_len; + +- memset(&req->wqe_req, 0, sizeof(struct gdma_wqe_request)); +- req->wqe_req.sgl = sge; +- req->wqe_req.num_sge = 1; +- req->wqe_req.client_data_unit = 0; ++ /* Must post rx wqe before complete(), otherwise the next rx may ++ * hit no_wqe error. ++ */ ++ mana_hwc_post_rx_wqe(hwc->rxq, rx_req); + +- err = mana_gd_post_and_ring(hwc_rxq->gdma_wq, &req->wqe_req, NULL); +- if (err) +- dev_err(dev, "Failed to post WQE on HWC RQ: %d\n", err); +- return err; ++ complete(&ctx->comp_event); + } + + static void mana_hwc_init_event_handler(void *ctx, struct gdma_queue *q_self, +@@ -216,14 +224,12 @@ static void mana_hwc_rx_event_handler(vo + return; + } + +- mana_hwc_handle_resp(hwc, rx_oob->tx_oob_data_size, resp); ++ mana_hwc_handle_resp(hwc, rx_oob->tx_oob_data_size, rx_req); + +- /* Do no longer use 'resp', because the buffer is posted to the HW +- * in the below mana_hwc_post_rx_wqe(). ++ /* Can no longer use 'resp', because the buffer is posted to the HW ++ * in mana_hwc_handle_resp() above. + */ + resp = NULL; +- +- mana_hwc_post_rx_wqe(hwc_rxq, rx_req); + } + + static void mana_hwc_tx_event_handler(void *ctx, u32 gdma_txq_id, diff --git a/queue-6.1/series b/queue-6.1/series index c514f20aa7d..a1c7c9e7a97 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -5,3 +5,15 @@ smb-client-avoid-dereferencing-rdata-null-in-smb2_new_read_req.patch pinctrl-rockchip-correct-rk3328-iomux-width-flag-for-gpio2-b-pins.patch pinctrl-single-fix-potential-null-dereference-in-pcs_get_function.patch of-add-cleanup.h-based-auto-release-via-__free-device_node-markings.patch +wifi-wfx-repair-open-network-ap-mode.patch +wifi-mwifiex-duplicate-static-structs-used-in-driver-instances.patch +net-mana-fix-race-of-mana_hwc_post_rx_wqe-and-new-hwc-response.patch +mptcp-close-subflow-when-receiving-tcp-fin.patch +mptcp-sched-check-both-backup-in-retrans.patch +mptcp-pm-skip-connecting-to-already-established-sf.patch +mptcp-pm-reset-mpc-endp-id-when-re-added.patch +mptcp-pm-send-ack-on-an-active-subflow.patch +mptcp-pm-do-not-remove-already-closed-subflows.patch +mptcp-pm-add_addr-0-is-not-a-new-address.patch +drm-amdgpu-align-pp_power_profile_mode-with-kernel-docs.patch +drm-amdgpu-swsmu-always-force-a-state-reprogram-on-init.patch diff --git a/queue-6.1/wifi-mwifiex-duplicate-static-structs-used-in-driver-instances.patch b/queue-6.1/wifi-mwifiex-duplicate-static-structs-used-in-driver-instances.patch new file mode 100644 index 00000000000..87d8473e0a0 --- /dev/null +++ b/queue-6.1/wifi-mwifiex-duplicate-static-structs-used-in-driver-instances.patch @@ -0,0 +1,84 @@ +From 27ec3c57fcadb43c79ed05b2ea31bc18c72d798a Mon Sep 17 00:00:00 2001 +From: Sascha Hauer +Date: Fri, 9 Aug 2024 10:11:33 +0200 +Subject: wifi: mwifiex: duplicate static structs used in driver instances + +From: Sascha Hauer + +commit 27ec3c57fcadb43c79ed05b2ea31bc18c72d798a upstream. + +mwifiex_band_2ghz and mwifiex_band_5ghz are statically allocated, but +used and modified in driver instances. Duplicate them before using +them in driver instances so that different driver instances do not +influence each other. + +This was observed on a board which has one PCIe and one SDIO mwifiex +adapter. It blew up in mwifiex_setup_ht_caps(). This was called with +the statically allocated struct which is modified in this function. + +Cc: stable@vger.kernel.org +Fixes: d6bffe8bb520 ("mwifiex: support for creation of AP interface") +Signed-off-by: Sascha Hauer +Reviewed-by: Francesco Dolcini +Acked-by: Brian Norris +Signed-off-by: Kalle Valo +Link: https://patch.msgid.link/20240809-mwifiex-duplicate-static-structs-v1-1-6837b903b1a4@pengutronix.de +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/marvell/mwifiex/cfg80211.c | 32 +++++++++++++++++++----- + 1 file changed, 26 insertions(+), 6 deletions(-) + +--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c ++++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c +@@ -4362,11 +4362,27 @@ int mwifiex_register_cfg80211(struct mwi + if (ISSUPP_ADHOC_ENABLED(adapter->fw_cap_info)) + wiphy->interface_modes |= BIT(NL80211_IFTYPE_ADHOC); + +- wiphy->bands[NL80211_BAND_2GHZ] = &mwifiex_band_2ghz; +- if (adapter->config_bands & BAND_A) +- wiphy->bands[NL80211_BAND_5GHZ] = &mwifiex_band_5ghz; +- else ++ wiphy->bands[NL80211_BAND_2GHZ] = devm_kmemdup(adapter->dev, ++ &mwifiex_band_2ghz, ++ sizeof(mwifiex_band_2ghz), ++ GFP_KERNEL); ++ if (!wiphy->bands[NL80211_BAND_2GHZ]) { ++ ret = -ENOMEM; ++ goto err; ++ } ++ ++ if (adapter->config_bands & BAND_A) { ++ wiphy->bands[NL80211_BAND_5GHZ] = devm_kmemdup(adapter->dev, ++ &mwifiex_band_5ghz, ++ sizeof(mwifiex_band_5ghz), ++ GFP_KERNEL); ++ if (!wiphy->bands[NL80211_BAND_5GHZ]) { ++ ret = -ENOMEM; ++ goto err; ++ } ++ } else { + wiphy->bands[NL80211_BAND_5GHZ] = NULL; ++ } + + if (adapter->drcs_enabled && ISSUPP_DRCS_ENABLED(adapter->fw_cap_info)) + wiphy->iface_combinations = &mwifiex_iface_comb_ap_sta_drcs; +@@ -4459,8 +4475,7 @@ int mwifiex_register_cfg80211(struct mwi + if (ret < 0) { + mwifiex_dbg(adapter, ERROR, + "%s: wiphy_register failed: %d\n", __func__, ret); +- wiphy_free(wiphy); +- return ret; ++ goto err; + } + + if (!adapter->regd) { +@@ -4502,4 +4517,9 @@ int mwifiex_register_cfg80211(struct mwi + + adapter->wiphy = wiphy; + return ret; ++ ++err: ++ wiphy_free(wiphy); ++ ++ return ret; + } diff --git a/queue-6.1/wifi-wfx-repair-open-network-ap-mode.patch b/queue-6.1/wifi-wfx-repair-open-network-ap-mode.patch new file mode 100644 index 00000000000..12f32c2b9fe --- /dev/null +++ b/queue-6.1/wifi-wfx-repair-open-network-ap-mode.patch @@ -0,0 +1,66 @@ +From 6d30bb88f623526197c0e18a366e68a4254a2c83 Mon Sep 17 00:00:00 2001 +From: Alexander Sverdlin +Date: Fri, 23 Aug 2024 15:15:20 +0200 +Subject: wifi: wfx: repair open network AP mode +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alexander Sverdlin + +commit 6d30bb88f623526197c0e18a366e68a4254a2c83 upstream. + +RSN IE missing in beacon is normal in open networks. +Avoid returning -EINVAL in this case. + +Steps to reproduce: + +$ cat /etc/wpa_supplicant.conf +network={ + ssid="testNet" + mode=2 + key_mgmt=NONE +} + +$ wpa_supplicant -iwlan0 -c /etc/wpa_supplicant.conf +nl80211: Beacon set failed: -22 (Invalid argument) +Failed to set beacon parameters +Interface initialization failed +wlan0: interface state UNINITIALIZED->DISABLED +wlan0: AP-DISABLED +wlan0: Unable to setup interface. +Failed to initialize AP interface + +After the change: + +$ wpa_supplicant -iwlan0 -c /etc/wpa_supplicant.conf +Successfully initialized wpa_supplicant +wlan0: interface state UNINITIALIZED->ENABLED +wlan0: AP-ENABLED + +Cc: stable@vger.kernel.org +Fixes: fe0a7776d4d1 ("wifi: wfx: fix possible NULL pointer dereference in wfx_set_mfp_ap()") +Signed-off-by: Alexander Sverdlin +Reviewed-by: Jérôme Pouiller +Signed-off-by: Kalle Valo +Link: https://patch.msgid.link/20240823131521.3309073-1-alexander.sverdlin@siemens.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/silabs/wfx/sta.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/net/wireless/silabs/wfx/sta.c ++++ b/drivers/net/wireless/silabs/wfx/sta.c +@@ -370,8 +370,11 @@ static int wfx_set_mfp_ap(struct wfx_vif + + ptr = (u16 *)cfg80211_find_ie(WLAN_EID_RSN, skb->data + ieoffset, + skb->len - ieoffset); +- if (unlikely(!ptr)) ++ if (!ptr) { ++ /* No RSN IE is fine in open networks */ ++ ret = 0; + goto free_skb; ++ } + + ptr += pairwise_cipher_suite_count_offset; + if (WARN_ON(ptr > (u16 *)skb_tail_pointer(skb)))