From: Sasha Levin Date: Sun, 23 Mar 2025 17:44:05 +0000 (-0400) Subject: Fixes for 5.10 X-Git-Tag: v6.1.132~37 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=398f7a927296eac1644470681f03b7ee72442e0a;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.10 Signed-off-by: Sasha Levin --- diff --git a/queue-5.10/arm-dts-bcm2711-don-t-mark-timer-regs-unconfigured.patch b/queue-5.10/arm-dts-bcm2711-don-t-mark-timer-regs-unconfigured.patch new file mode 100644 index 0000000000..e15024cd0e --- /dev/null +++ b/queue-5.10/arm-dts-bcm2711-don-t-mark-timer-regs-unconfigured.patch @@ -0,0 +1,44 @@ +From 63f948f57739104b09825b1f350162b0b7bd4bed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 22 Feb 2025 10:41:13 +0100 +Subject: ARM: dts: bcm2711: Don't mark timer regs unconfigured + +From: Phil Elwell + +[ Upstream commit c24f272ae751a9f54f8816430e7f2d56031892cc ] + +During upstream process of Raspberry Pi 4 back in 2019 the ARMv7 stubs +didn't configured the ARM architectural timer. This firmware issue has +been fixed in 2020, which gave users enough time to update their system. + +So drop this property to allow the use of the vDSO version of +clock_gettime. + +Link: https://github.com/raspberrypi/tools/pull/113 +Fixes: 7dbe8c62ceeb ("ARM: dts: Add minimal Raspberry Pi 4 support") +Signed-off-by: Phil Elwell +Signed-off-by: Stefan Wahren +Reviewed-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20250222094113.48198-1-wahrenst@gmx.net +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/bcm2711.dtsi | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/arch/arm/boot/dts/bcm2711.dtsi b/arch/arm/boot/dts/bcm2711.dtsi +index 0f559f2653920..9bb98338609b6 100644 +--- a/arch/arm/boot/dts/bcm2711.dtsi ++++ b/arch/arm/boot/dts/bcm2711.dtsi +@@ -424,8 +424,6 @@ IRQ_TYPE_LEVEL_LOW)>, + IRQ_TYPE_LEVEL_LOW)>, + ; +- /* This only applies to the ARMv7 stub */ +- arm,cpu-registers-not-fw-configured; + }; + + cpus: cpus { +-- +2.39.5 + diff --git a/queue-5.10/arm-dts-bcm2711-pl011-uarts-are-actually-r1p5.patch b/queue-5.10/arm-dts-bcm2711-pl011-uarts-are-actually-r1p5.patch new file mode 100644 index 0000000000..845cbcf85e --- /dev/null +++ b/queue-5.10/arm-dts-bcm2711-pl011-uarts-are-actually-r1p5.patch @@ -0,0 +1,74 @@ +From 518ee28dcd03708c58f14dff3cdacd0dc3e9f00f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 23 Feb 2025 13:56:13 +0100 +Subject: ARM: dts: bcm2711: PL011 UARTs are actually r1p5 + +From: Phil Elwell + +[ Upstream commit 0de09025f161f67c07978c4742e221243d070d41 ] + +The ARM PL011 UART instances in BCM2711 are r1p5 spec, which means they +have 32-entry FIFOs. The correct periphid value for this is 0x00341011. +Thanks to N Buchwitz for pointing this out. + +Signed-off-by: Phil Elwell +Signed-off-by: Stefan Wahren +Link: https://lore.kernel.org/r/20250223125614.3592-2-wahrenst@gmx.net +Fixes: 7dbe8c62ceeb ("ARM: dts: Add minimal Raspberry Pi 4 support") +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/bcm2711.dtsi | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/arch/arm/boot/dts/bcm2711.dtsi b/arch/arm/boot/dts/bcm2711.dtsi +index b50229c3102fa..0f559f2653920 100644 +--- a/arch/arm/boot/dts/bcm2711.dtsi ++++ b/arch/arm/boot/dts/bcm2711.dtsi +@@ -133,7 +133,7 @@ uart2: serial@7e201400 { + clocks = <&clocks BCM2835_CLOCK_UART>, + <&clocks BCM2835_CLOCK_VPU>; + clock-names = "uartclk", "apb_pclk"; +- arm,primecell-periphid = <0x00241011>; ++ arm,primecell-periphid = <0x00341011>; + status = "disabled"; + }; + +@@ -144,7 +144,7 @@ uart3: serial@7e201600 { + clocks = <&clocks BCM2835_CLOCK_UART>, + <&clocks BCM2835_CLOCK_VPU>; + clock-names = "uartclk", "apb_pclk"; +- arm,primecell-periphid = <0x00241011>; ++ arm,primecell-periphid = <0x00341011>; + status = "disabled"; + }; + +@@ -155,7 +155,7 @@ uart4: serial@7e201800 { + clocks = <&clocks BCM2835_CLOCK_UART>, + <&clocks BCM2835_CLOCK_VPU>; + clock-names = "uartclk", "apb_pclk"; +- arm,primecell-periphid = <0x00241011>; ++ arm,primecell-periphid = <0x00341011>; + status = "disabled"; + }; + +@@ -166,7 +166,7 @@ uart5: serial@7e201a00 { + clocks = <&clocks BCM2835_CLOCK_UART>, + <&clocks BCM2835_CLOCK_VPU>; + clock-names = "uartclk", "apb_pclk"; +- arm,primecell-periphid = <0x00241011>; ++ arm,primecell-periphid = <0x00341011>; + status = "disabled"; + }; + +@@ -1115,6 +1115,7 @@ &txp { + }; + + &uart0 { ++ arm,primecell-periphid = <0x00341011>; + interrupts = ; + }; + +-- +2.39.5 + diff --git a/queue-5.10/bluetooth-fix-error-code-in-chan_alloc_skb_cb.patch b/queue-5.10/bluetooth-fix-error-code-in-chan_alloc_skb_cb.patch new file mode 100644 index 0000000000..fee7a4fdbb --- /dev/null +++ b/queue-5.10/bluetooth-fix-error-code-in-chan_alloc_skb_cb.patch @@ -0,0 +1,45 @@ +From 82b33884158c0ecdb8a931cca712da1bc4125326 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Mar 2025 22:46:56 +0300 +Subject: Bluetooth: Fix error code in chan_alloc_skb_cb() + +From: Dan Carpenter + +[ Upstream commit 72d061ee630d0dbb45c2920d8d19b3861c413e54 ] + +The chan_alloc_skb_cb() function is supposed to return error pointers on +error. Returning NULL will lead to a NULL dereference. + +Fixes: 6b8d4a6a0314 ("Bluetooth: 6LoWPAN: Use connected oriented channel instead of fixed one") +Signed-off-by: Dan Carpenter +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/6lowpan.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c +index 7601ce9143c18..7e698b0ac7bc7 100644 +--- a/net/bluetooth/6lowpan.c ++++ b/net/bluetooth/6lowpan.c +@@ -855,11 +855,16 @@ static struct sk_buff *chan_alloc_skb_cb(struct l2cap_chan *chan, + unsigned long hdr_len, + unsigned long len, int nb) + { ++ struct sk_buff *skb; ++ + /* Note that we must allocate using GFP_ATOMIC here as + * this function is called originally from netdev hard xmit + * function in atomic context. + */ +- return bt_skb_alloc(hdr_len + len, GFP_ATOMIC); ++ skb = bt_skb_alloc(hdr_len + len, GFP_ATOMIC); ++ if (!skb) ++ return ERR_PTR(-ENOMEM); ++ return skb; + } + + static void chan_suspend_cb(struct l2cap_chan *chan) +-- +2.39.5 + diff --git a/queue-5.10/firmware-imx-scu-fix-of-node-leak-in-.probe.patch b/queue-5.10/firmware-imx-scu-fix-of-node-leak-in-.probe.patch new file mode 100644 index 0000000000..aac61b7574 --- /dev/null +++ b/queue-5.10/firmware-imx-scu-fix-of-node-leak-in-.probe.patch @@ -0,0 +1,36 @@ +From bc64c813ee9c12cf3c8ff2759e80b8bb2db37242 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Dec 2024 12:34:56 +0900 +Subject: firmware: imx-scu: fix OF node leak in .probe() + +From: Joe Hattori + +[ Upstream commit fbf10b86f6057cf79300720da4ea4b77e6708b0d ] + +imx_scu_probe() calls of_parse_phandle_with_args(), but does not +release the OF node reference obtained by it. Add a of_node_put() call +after done with the node. + +Fixes: f25a066d1a07 ("firmware: imx-scu: Support one TX and one RX") +Signed-off-by: Joe Hattori +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + drivers/firmware/imx/imx-scu.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/firmware/imx/imx-scu.c b/drivers/firmware/imx/imx-scu.c +index dca79caccd01c..fa25c082109ac 100644 +--- a/drivers/firmware/imx/imx-scu.c ++++ b/drivers/firmware/imx/imx-scu.c +@@ -279,6 +279,7 @@ static int imx_scu_probe(struct platform_device *pdev) + return ret; + + sc_ipc->fast_ipc = of_device_is_compatible(args.np, "fsl,imx8-mu-scu"); ++ of_node_put(args.np); + + num_channel = sc_ipc->fast_ipc ? 2 : SCU_MU_CHAN_NUM; + for (i = 0; i < num_channel; i++) { +-- +2.39.5 + diff --git a/queue-5.10/ipv6-fix-memleak-of-nhc_pcpu_rth_output-in-fib_check.patch b/queue-5.10/ipv6-fix-memleak-of-nhc_pcpu_rth_output-in-fib_check.patch new file mode 100644 index 0000000000..672b429e31 --- /dev/null +++ b/queue-5.10/ipv6-fix-memleak-of-nhc_pcpu_rth_output-in-fib_check.patch @@ -0,0 +1,49 @@ +From dc79b6a74d1dcaf648c129a31a4ceb2f7d475345 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Mar 2025 18:03:25 -0700 +Subject: ipv6: Fix memleak of nhc_pcpu_rth_output in fib_check_nh_v6_gw(). + +From: Kuniyuki Iwashima + +[ Upstream commit 9740890ee20e01f99ff1dde84c63dcf089fabb98 ] + +fib_check_nh_v6_gw() expects that fib6_nh_init() cleans up everything +when it fails. + +Commit 7dd73168e273 ("ipv6: Always allocate pcpu memory in a fib6_nh") +moved fib_nh_common_init() before alloc_percpu_gfp() within fib6_nh_init() +but forgot to add cleanup for fib6_nh->nh_common.nhc_pcpu_rth_output in +case it fails to allocate fib6_nh->rt6i_pcpu, resulting in memleak. + +Let's call fib_nh_common_release() and clear nhc_pcpu_rth_output in the +error path. + +Note that we can remove the fib6_nh_release() call in nh_create_ipv6() +later in net-next.git. + +Fixes: 7dd73168e273 ("ipv6: Always allocate pcpu memory in a fib6_nh") +Signed-off-by: Kuniyuki Iwashima +Link: https://patch.msgid.link/20250312010333.56001-1-kuniyu@amazon.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/ipv6/route.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/ipv6/route.c b/net/ipv6/route.c +index 178c56f6f6185..802386b3937f7 100644 +--- a/net/ipv6/route.c ++++ b/net/ipv6/route.c +@@ -3519,7 +3519,8 @@ int fib6_nh_init(struct net *net, struct fib6_nh *fib6_nh, + in6_dev_put(idev); + + if (err) { +- lwtstate_put(fib6_nh->fib_nh_lws); ++ fib_nh_common_release(&fib6_nh->nh_common); ++ fib6_nh->nh_common.nhc_pcpu_rth_output = NULL; + fib6_nh->fib_nh_lws = NULL; + if (dev) + dev_put(dev); +-- +2.39.5 + diff --git a/queue-5.10/ipv6-set-errno-after-ip_fib_metrics_init-in-ip6_rout.patch b/queue-5.10/ipv6-set-errno-after-ip_fib_metrics_init-in-ip6_rout.patch new file mode 100644 index 0000000000..83d7be2682 --- /dev/null +++ b/queue-5.10/ipv6-set-errno-after-ip_fib_metrics_init-in-ip6_rout.patch @@ -0,0 +1,57 @@ +From 9738355797a751c42a621fbe277dff5d29d0aa4d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Mar 2025 18:38:48 -0700 +Subject: ipv6: Set errno after ip_fib_metrics_init() in + ip6_route_info_create(). + +From: Kuniyuki Iwashima + +[ Upstream commit 9a81fc3480bf5dbe2bf80e278c440770f6ba2692 ] + +While creating a new IPv6, we could get a weird -ENOMEM when +RTA_NH_ID is set and either of the conditions below is true: + + 1) CONFIG_IPV6_SUBTREES is enabled and rtm_src_len is specified + 2) nexthop_get() fails + +e.g.) + + # strace ip -6 route add fe80::dead:beef:dead:beef nhid 1 from :: + recvmsg(3, {msg_iov=[{iov_base=[...[ + {error=-ENOMEM, msg=[... [...]]}, + [{nla_len=49, nla_type=NLMSGERR_ATTR_MSG}, "Nexthops can not be used with so"...] + ]], iov_len=32768}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 148 + +Let's set err explicitly after ip_fib_metrics_init() in +ip6_route_info_create(). + +Fixes: f88d8ea67fbd ("ipv6: Plumb support for nexthop object in a fib6_info") +Signed-off-by: Kuniyuki Iwashima +Reviewed-by: David Ahern +Link: https://patch.msgid.link/20250312013854.61125-1-kuniyu@amazon.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/ipv6/route.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/ipv6/route.c b/net/ipv6/route.c +index 802386b3937f7..b47f89600c2f8 100644 +--- a/net/ipv6/route.c ++++ b/net/ipv6/route.c +@@ -3697,10 +3697,12 @@ static struct fib6_info *ip6_route_info_create(struct fib6_config *cfg, + if (nh) { + if (rt->fib6_src.plen) { + NL_SET_ERR_MSG(extack, "Nexthops can not be used with source routing"); ++ err = -EINVAL; + goto out_free; + } + if (!nexthop_get(nh)) { + NL_SET_ERR_MSG(extack, "Nexthop has been deleted"); ++ err = -ENOENT; + goto out_free; + } + rt->nh = nh; +-- +2.39.5 + diff --git a/queue-5.10/net-atm-fix-use-after-free-in-lec_send.patch b/queue-5.10/net-atm-fix-use-after-free-in-lec_send.patch new file mode 100644 index 0000000000..012aa2e98e --- /dev/null +++ b/queue-5.10/net-atm-fix-use-after-free-in-lec_send.patch @@ -0,0 +1,46 @@ +From 3a0c4d4975bd3fd7287b4a18ca506a113c9b60c6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Mar 2025 13:10:57 +0300 +Subject: net: atm: fix use after free in lec_send() + +From: Dan Carpenter + +[ Upstream commit f3009d0d6ab78053117f8857b921a8237f4d17b3 ] + +The ->send() operation frees skb so save the length before calling +->send() to avoid a use after free. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Dan Carpenter +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/c751531d-4af4-42fe-affe-6104b34b791d@stanley.mountain +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/atm/lec.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/atm/lec.c b/net/atm/lec.c +index 7226c784dbe0c..ca9952c52fb5c 100644 +--- a/net/atm/lec.c ++++ b/net/atm/lec.c +@@ -181,6 +181,7 @@ static void + lec_send(struct atm_vcc *vcc, struct sk_buff *skb) + { + struct net_device *dev = skb->dev; ++ unsigned int len = skb->len; + + ATM_SKB(skb)->vcc = vcc; + atm_account_tx(vcc, skb); +@@ -191,7 +192,7 @@ lec_send(struct atm_vcc *vcc, struct sk_buff *skb) + } + + dev->stats.tx_packets++; +- dev->stats.tx_bytes += skb->len; ++ dev->stats.tx_bytes += len; + } + + static void lec_tx_timeout(struct net_device *dev, unsigned int txqueue) +-- +2.39.5 + diff --git a/queue-5.10/net-neighbor-add-missing-policy-for-ndtpa_queue_lenb.patch b/queue-5.10/net-neighbor-add-missing-policy-for-ndtpa_queue_lenb.patch new file mode 100644 index 0000000000..68f064bdb1 --- /dev/null +++ b/queue-5.10/net-neighbor-add-missing-policy-for-ndtpa_queue_lenb.patch @@ -0,0 +1,39 @@ +From 649e95564ad0fe206e88eaaf616edc796d7d0933 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 16 Mar 2025 00:51:13 +0800 +Subject: net/neighbor: add missing policy for NDTPA_QUEUE_LENBYTES + +From: Lin Ma + +[ Upstream commit 90a7138619a0c55e2aefaad27b12ffc2ddbeed78 ] + +Previous commit 8b5c171bb3dc ("neigh: new unresolved queue limits") +introduces new netlink attribute NDTPA_QUEUE_LENBYTES to represent +approximative value for deprecated QUEUE_LEN. However, it forgot to add +the associated nla_policy in nl_ntbl_parm_policy array. Fix it with one +simple NLA_U32 type policy. + +Fixes: 8b5c171bb3dc ("neigh: new unresolved queue limits") +Signed-off-by: Lin Ma +Link: https://patch.msgid.link/20250315165113.37600-1-linma@zju.edu.cn +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/core/neighbour.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/core/neighbour.c b/net/core/neighbour.c +index f04ba63e98515..37f7bcbc2adcc 100644 +--- a/net/core/neighbour.c ++++ b/net/core/neighbour.c +@@ -2181,6 +2181,7 @@ static const struct nla_policy nl_neightbl_policy[NDTA_MAX+1] = { + static const struct nla_policy nl_ntbl_parm_policy[NDTPA_MAX+1] = { + [NDTPA_IFINDEX] = { .type = NLA_U32 }, + [NDTPA_QUEUE_LEN] = { .type = NLA_U32 }, ++ [NDTPA_QUEUE_LENBYTES] = { .type = NLA_U32 }, + [NDTPA_PROXY_QLEN] = { .type = NLA_U32 }, + [NDTPA_APP_PROBES] = { .type = NLA_U32 }, + [NDTPA_UCAST_PROBES] = { .type = NLA_U32 }, +-- +2.39.5 + diff --git a/queue-5.10/rdma-bnxt_re-add-missing-paranthesis-in-map_qp_id_to.patch b/queue-5.10/rdma-bnxt_re-add-missing-paranthesis-in-map_qp_id_to.patch new file mode 100644 index 0000000000..6fae5b205a --- /dev/null +++ b/queue-5.10/rdma-bnxt_re-add-missing-paranthesis-in-map_qp_id_to.patch @@ -0,0 +1,42 @@ +From 814b00ee9e5cefffa999c124edaa1e69e8476779 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Mar 2025 08:59:37 -0800 +Subject: RDMA/bnxt_re: Add missing paranthesis in map_qp_id_to_tbl_indx + +From: Kashyap Desai + +[ Upstream commit 67ee8d496511ad8e1cb88f72944847e7b3e4e47c ] + +The modulo operation returns wrong result without the +paranthesis and that resulted in wrong QP table indexing. + +Fixes: 84cf229f4001 ("RDMA/bnxt_re: Fix the qp table indexing") +Reviewed-by: Kalesh AP +Signed-off-by: Kashyap Desai +Signed-off-by: Selvin Xavier +Link: https://patch.msgid.link/1741021178-2569-3-git-send-email-selvin.xavier@broadcom.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/bnxt_re/qplib_rcfw.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h +index 69aa1a52c7f8d..db98fac4b5624 100644 +--- a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h ++++ b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h +@@ -218,9 +218,10 @@ int bnxt_qplib_deinit_rcfw(struct bnxt_qplib_rcfw *rcfw); + int bnxt_qplib_init_rcfw(struct bnxt_qplib_rcfw *rcfw, + struct bnxt_qplib_ctx *ctx, int is_virtfn); + void bnxt_qplib_mark_qp_error(void *qp_handle); ++ + static inline u32 map_qp_id_to_tbl_indx(u32 qid, struct bnxt_qplib_rcfw *rcfw) + { + /* Last index of the qp_tbl is for QP1 ie. qp_tbl_size - 1*/ +- return (qid == 1) ? rcfw->qp_tbl_size - 1 : qid % rcfw->qp_tbl_size - 2; ++ return (qid == 1) ? rcfw->qp_tbl_size - 1 : (qid % (rcfw->qp_tbl_size - 2)); + } + #endif /* __BNXT_QPLIB_RCFW_H__ */ +-- +2.39.5 + diff --git a/queue-5.10/rdma-bnxt_re-avoid-clearing-vlan_id-mask-in-modify-q.patch b/queue-5.10/rdma-bnxt_re-avoid-clearing-vlan_id-mask-in-modify-q.patch new file mode 100644 index 0000000000..d3cd7eacc1 --- /dev/null +++ b/queue-5.10/rdma-bnxt_re-avoid-clearing-vlan_id-mask-in-modify-q.patch @@ -0,0 +1,42 @@ +From ac481328b824d61272470ddd88ec0da709c8a6cb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Mar 2025 22:16:36 -0700 +Subject: RDMA/bnxt_re: Avoid clearing VLAN_ID mask in modify qp path + +From: Saravanan Vajravel + +[ Upstream commit 81c0db302a674f8004ed805393d17fd76f552e83 ] + +Driver is always clearing the mask that sets the VLAN ID/Service Level +in the adapter. Recent change for supporting multiple traffic class +exposed this issue. + +Allow setting SL and VLAN_ID while QP is moved from INIT to RTR state. + +Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver") +Fixes: c64b16a37b6d ("RDMA/bnxt_re: Support different traffic class") +Signed-off-by: Saravanan Vajravel +Signed-off-by: Selvin Xavier +Link: https://patch.msgid.link/1741670196-2919-1-git-send-email-selvin.xavier@broadcom.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/bnxt_re/qplib_fp.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.c b/drivers/infiniband/hw/bnxt_re/qplib_fp.c +index 4ed78d25b6e9a..d5bb8017a468e 100644 +--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c ++++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c +@@ -1163,8 +1163,6 @@ static void __modify_flags_from_init_state(struct bnxt_qplib_qp *qp) + qp->path_mtu = + CMDQ_MODIFY_QP_PATH_MTU_MTU_2048; + } +- qp->modify_flags &= +- ~CMDQ_MODIFY_QP_MODIFY_MASK_VLAN_ID; + /* Bono FW require the max_dest_rd_atomic to be >= 1 */ + if (qp->max_dest_rd_atomic < 1) + qp->max_dest_rd_atomic = 1; +-- +2.39.5 + diff --git a/queue-5.10/rdma-hns-fix-soft-lockup-during-bt-pages-loop.patch b/queue-5.10/rdma-hns-fix-soft-lockup-during-bt-pages-loop.patch new file mode 100644 index 0000000000..eafe2136f9 --- /dev/null +++ b/queue-5.10/rdma-hns-fix-soft-lockup-during-bt-pages-loop.patch @@ -0,0 +1,100 @@ +From 42091f81b8f1a4bd37573d0c0f23607205793636 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Mar 2025 16:48:52 +0800 +Subject: RDMA/hns: Fix soft lockup during bt pages loop + +From: Junxian Huang + +[ Upstream commit 25655580136de59ec89f09089dd28008ea440fc9 ] + +Driver runs a for-loop when allocating bt pages and mapping them with +buffer pages. When a large buffer (e.g. MR over 100GB) is being allocated, +it may require a considerable loop count. This will lead to soft lockup: + + watchdog: BUG: soft lockup - CPU#27 stuck for 22s! + ... + Call trace: + hem_list_alloc_mid_bt+0x124/0x394 [hns_roce_hw_v2] + hns_roce_hem_list_request+0xf8/0x160 [hns_roce_hw_v2] + hns_roce_mtr_create+0x2e4/0x360 [hns_roce_hw_v2] + alloc_mr_pbl+0xd4/0x17c [hns_roce_hw_v2] + hns_roce_reg_user_mr+0xf8/0x190 [hns_roce_hw_v2] + ib_uverbs_reg_mr+0x118/0x290 + + watchdog: BUG: soft lockup - CPU#35 stuck for 23s! + ... + Call trace: + hns_roce_hem_list_find_mtt+0x7c/0xb0 [hns_roce_hw_v2] + mtr_map_bufs+0xc4/0x204 [hns_roce_hw_v2] + hns_roce_mtr_create+0x31c/0x3c4 [hns_roce_hw_v2] + alloc_mr_pbl+0xb0/0x160 [hns_roce_hw_v2] + hns_roce_reg_user_mr+0x108/0x1c0 [hns_roce_hw_v2] + ib_uverbs_reg_mr+0x120/0x2bc + +Add a cond_resched() to fix soft lockup during these loops. In order not +to affect the allocation performance of normal-size buffer, set the loop +count of a 100GB MR as the threshold to call cond_resched(). + +Fixes: 38389eaa4db1 ("RDMA/hns: Add mtr support for mixed multihop addressing") +Signed-off-by: Junxian Huang +Link: https://patch.msgid.link/20250311084857.3803665-3-huangjunxian6@hisilicon.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_hem.c | 16 +++++++++++++++- + 1 file changed, 15 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_hem.c b/drivers/infiniband/hw/hns/hns_roce_hem.c +index d4169dc584ed7..7cb98d09fb9b2 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_hem.c ++++ b/drivers/infiniband/hw/hns/hns_roce_hem.c +@@ -1384,6 +1384,11 @@ static int hem_list_alloc_root_bt(struct hns_roce_dev *hr_dev, + return ret; + } + ++/* This is the bottom bt pages number of a 100G MR on 4K OS, assuming ++ * the bt page size is not expanded by cal_best_bt_pg_sz() ++ */ ++#define RESCHED_LOOP_CNT_THRESHOLD_ON_4K 12800 ++ + /* construct the base address table and link them by address hop config */ + int hns_roce_hem_list_request(struct hns_roce_dev *hr_dev, + struct hns_roce_hem_list *hem_list, +@@ -1392,6 +1397,7 @@ int hns_roce_hem_list_request(struct hns_roce_dev *hr_dev, + { + const struct hns_roce_buf_region *r; + int ofs, end; ++ int loop; + int unit; + int ret; + int i; +@@ -1409,7 +1415,10 @@ int hns_roce_hem_list_request(struct hns_roce_dev *hr_dev, + continue; + + end = r->offset + r->count; +- for (ofs = r->offset; ofs < end; ofs += unit) { ++ for (ofs = r->offset, loop = 1; ofs < end; ofs += unit, loop++) { ++ if (!(loop % RESCHED_LOOP_CNT_THRESHOLD_ON_4K)) ++ cond_resched(); ++ + ret = hem_list_alloc_mid_bt(hr_dev, r, unit, ofs, + hem_list->mid_bt[i], + &hem_list->btm_bt); +@@ -1467,9 +1476,14 @@ void *hns_roce_hem_list_find_mtt(struct hns_roce_dev *hr_dev, + struct list_head *head = &hem_list->btm_bt; + struct hns_roce_hem_item *hem, *temp_hem; + void *cpu_base = NULL; ++ int loop = 1; + int nr = 0; + + list_for_each_entry_safe(hem, temp_hem, head, sibling) { ++ if (!(loop % RESCHED_LOOP_CNT_THRESHOLD_ON_4K)) ++ cond_resched(); ++ loop++; ++ + if (hem_list_page_is_in_range(hem, offset)) { + nr = offset - hem->start; + cpu_base = hem->addr + nr * BA_BYTE_LEN; +-- +2.39.5 + diff --git a/queue-5.10/rdma-hns-fix-wrong-value-of-max_sge_rd.patch b/queue-5.10/rdma-hns-fix-wrong-value-of-max_sge_rd.patch new file mode 100644 index 0000000000..41f3c16ac1 --- /dev/null +++ b/queue-5.10/rdma-hns-fix-wrong-value-of-max_sge_rd.patch @@ -0,0 +1,38 @@ +From 9b36f711fa6da0b197f99d6d14001f936f1da80b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Mar 2025 16:48:57 +0800 +Subject: RDMA/hns: Fix wrong value of max_sge_rd + +From: Junxian Huang + +[ Upstream commit 6b5e41a8b51fce520bb09bd651a29ef495e990de ] + +There is no difference between the sge of READ and non-READ +operations in hns RoCE. Set max_sge_rd to the same value as +max_send_sge. + +Fixes: 9a4435375cd1 ("IB/hns: Add driver files for hns RoCE driver") +Signed-off-by: Junxian Huang +Link: https://patch.msgid.link/20250311084857.3803665-8-huangjunxian6@hisilicon.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_main.c b/drivers/infiniband/hw/hns/hns_roce_main.c +index a0f243ffa5b54..f520e43e4e146 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_main.c ++++ b/drivers/infiniband/hw/hns/hns_roce_main.c +@@ -199,7 +199,7 @@ static int hns_roce_query_device(struct ib_device *ib_dev, + IB_DEVICE_RC_RNR_NAK_GEN; + props->max_send_sge = hr_dev->caps.max_sq_sg; + props->max_recv_sge = hr_dev->caps.max_rq_sg; +- props->max_sge_rd = 1; ++ props->max_sge_rd = hr_dev->caps.max_sq_sg; + props->max_cq = hr_dev->caps.num_cqs; + props->max_cqe = hr_dev->caps.max_cqes; + props->max_mr = hr_dev->caps.num_mtpts; +-- +2.39.5 + diff --git a/queue-5.10/rdma-hns-remove-redundant-phy_addr-in-hns_roce_hem_l.patch b/queue-5.10/rdma-hns-remove-redundant-phy_addr-in-hns_roce_hem_l.patch new file mode 100644 index 0000000000..dd67b9a8ee --- /dev/null +++ b/queue-5.10/rdma-hns-remove-redundant-phy_addr-in-hns_roce_hem_l.patch @@ -0,0 +1,96 @@ +From c594407281e36471576a4bfc55573938ccf769c5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Sep 2022 20:33:10 +0800 +Subject: RDMA/hns: Remove redundant 'phy_addr' in hns_roce_hem_list_find_mtt() + +From: Chengchang Tang + +[ Upstream commit 5f652387c5423a82453c5cb446a88834bf41a94b ] + +This parameter has never been used. Remove it to simplify the function. + +Link: https://lore.kernel.org/r/20220922123315.3732205-8-xuhaoyue1@hisilicon.com +Signed-off-by: Chengchang Tang +Signed-off-by: Yunsheng Lin +Signed-off-by: Haoyue Xu +Signed-off-by: Jason Gunthorpe +Stable-dep-of: 25655580136d ("RDMA/hns: Fix soft lockup during bt pages loop") +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_hem.c | 7 +------ + drivers/infiniband/hw/hns/hns_roce_hem.h | 2 +- + drivers/infiniband/hw/hns/hns_roce_mr.c | 4 ++-- + 3 files changed, 4 insertions(+), 9 deletions(-) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_hem.c b/drivers/infiniband/hw/hns/hns_roce_hem.c +index 61ec96b3a89d5..d4169dc584ed7 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_hem.c ++++ b/drivers/infiniband/hw/hns/hns_roce_hem.c +@@ -1462,19 +1462,17 @@ void hns_roce_hem_list_init(struct hns_roce_hem_list *hem_list) + + void *hns_roce_hem_list_find_mtt(struct hns_roce_dev *hr_dev, + struct hns_roce_hem_list *hem_list, +- int offset, int *mtt_cnt, u64 *phy_addr) ++ int offset, int *mtt_cnt) + { + struct list_head *head = &hem_list->btm_bt; + struct hns_roce_hem_item *hem, *temp_hem; + void *cpu_base = NULL; +- u64 phy_base = 0; + int nr = 0; + + list_for_each_entry_safe(hem, temp_hem, head, sibling) { + if (hem_list_page_is_in_range(hem, offset)) { + nr = offset - hem->start; + cpu_base = hem->addr + nr * BA_BYTE_LEN; +- phy_base = hem->dma_addr + nr * BA_BYTE_LEN; + nr = hem->end + 1 - offset; + break; + } +@@ -1483,8 +1481,5 @@ void *hns_roce_hem_list_find_mtt(struct hns_roce_dev *hr_dev, + if (mtt_cnt) + *mtt_cnt = nr; + +- if (phy_addr) +- *phy_addr = phy_base; +- + return cpu_base; + } +diff --git a/drivers/infiniband/hw/hns/hns_roce_hem.h b/drivers/infiniband/hw/hns/hns_roce_hem.h +index 5b2162a2b8cef..ecf5159aba9fa 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_hem.h ++++ b/drivers/infiniband/hw/hns/hns_roce_hem.h +@@ -131,7 +131,7 @@ void hns_roce_hem_list_release(struct hns_roce_dev *hr_dev, + struct hns_roce_hem_list *hem_list); + void *hns_roce_hem_list_find_mtt(struct hns_roce_dev *hr_dev, + struct hns_roce_hem_list *hem_list, +- int offset, int *mtt_cnt, u64 *phy_addr); ++ int offset, int *mtt_cnt); + + static inline void hns_roce_hem_first(struct hns_roce_hem *hem, + struct hns_roce_hem_iter *iter) +diff --git a/drivers/infiniband/hw/hns/hns_roce_mr.c b/drivers/infiniband/hw/hns/hns_roce_mr.c +index b062301258683..66098d25cb49e 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_mr.c ++++ b/drivers/infiniband/hw/hns/hns_roce_mr.c +@@ -649,7 +649,7 @@ static int mtr_map_region(struct hns_roce_dev *hr_dev, struct hns_roce_mtr *mtr, + while (offset < end && npage < max_count) { + count = 0; + mtts = hns_roce_hem_list_find_mtt(hr_dev, &mtr->hem_list, +- offset, &count, NULL); ++ offset, &count); + if (!mtts) + return -ENOBUFS; + +@@ -923,7 +923,7 @@ int hns_roce_mtr_find(struct hns_roce_dev *hr_dev, struct hns_roce_mtr *mtr, + mtt_count = 0; + mtts = hns_roce_hem_list_find_mtt(hr_dev, &mtr->hem_list, + start_index + total, +- &mtt_count, NULL); ++ &mtt_count); + if (!mtts || !mtt_count) + goto done; + +-- +2.39.5 + diff --git a/queue-5.10/series b/queue-5.10/series index 6eb9ef1add..a8c97b57db 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -65,3 +65,17 @@ drm-amd-display-reject-too-small-viewport-size-when-.patch drm-amd-display-fix-odm-scaling.patch drm-amd-display-check-for-invalid-input-params-when-.patch drm-amd-display-fix-null-check-for-pipe_ctx-plane_st.patch +firmware-imx-scu-fix-of-node-leak-in-.probe.patch +xfrm_output-force-software-gso-only-in-tunnel-mode.patch +arm-dts-bcm2711-pl011-uarts-are-actually-r1p5.patch +rdma-bnxt_re-add-missing-paranthesis-in-map_qp_id_to.patch +arm-dts-bcm2711-don-t-mark-timer-regs-unconfigured.patch +rdma-bnxt_re-avoid-clearing-vlan_id-mask-in-modify-q.patch +rdma-hns-remove-redundant-phy_addr-in-hns_roce_hem_l.patch +rdma-hns-fix-soft-lockup-during-bt-pages-loop.patch +rdma-hns-fix-wrong-value-of-max_sge_rd.patch +bluetooth-fix-error-code-in-chan_alloc_skb_cb.patch +ipv6-fix-memleak-of-nhc_pcpu_rth_output-in-fib_check.patch +ipv6-set-errno-after-ip_fib_metrics_init-in-ip6_rout.patch +net-atm-fix-use-after-free-in-lec_send.patch +net-neighbor-add-missing-policy-for-ndtpa_queue_lenb.patch diff --git a/queue-5.10/xfrm_output-force-software-gso-only-in-tunnel-mode.patch b/queue-5.10/xfrm_output-force-software-gso-only-in-tunnel-mode.patch new file mode 100644 index 0000000000..d27eb7b771 --- /dev/null +++ b/queue-5.10/xfrm_output-force-software-gso-only-in-tunnel-mode.patch @@ -0,0 +1,77 @@ +From ac522a12271c3d43d44f3470c7ec5bf5b4f43ddb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Feb 2025 12:52:48 +0200 +Subject: xfrm_output: Force software GSO only in tunnel mode + +From: Cosmin Ratiu + +[ Upstream commit 0aae2867aa6067f73d066bc98385e23c8454a1d7 ] + +The cited commit fixed a software GSO bug with VXLAN + IPSec in tunnel +mode. Unfortunately, it is slightly broader than necessary, as it also +severely affects performance for Geneve + IPSec transport mode over a +device capable of both HW GSO and IPSec crypto offload. In this case, +xfrm_output unnecessarily triggers software GSO instead of letting the +HW do it. In simple iperf3 tests over Geneve + IPSec transport mode over +a back-2-back pair of NICs with MTU 1500, the performance was observed +to be up to 6x worse when doing software GSO compared to leaving it to +the hardware. + +This commit makes xfrm_output only trigger software GSO in crypto +offload cases for already encapsulated packets in tunnel mode, as not +doing so would then cause the inner tunnel skb->inner_networking_header +to be overwritten and break software GSO for that packet later if the +device turns out to not be capable of HW GSO. + +Taking a closer look at the conditions for the original bug, to better +understand the reasons for this change: +- vxlan_build_skb -> iptunnel_handle_offloads sets inner_protocol and + inner network header. +- then, udp_tunnel_xmit_skb -> ip_tunnel_xmit adds outer transport and + network headers. +- later in the xmit path, xfrm_output -> xfrm_outer_mode_output -> + xfrm4_prepare_output -> xfrm4_tunnel_encap_add overwrites the inner + network header with the one set in ip_tunnel_xmit before adding the + second outer header. +- __dev_queue_xmit -> validate_xmit_skb checks whether GSO segmentation + needs to happen based on dev features. In the original bug, the hw + couldn't segment the packets, so skb_gso_segment was invoked. +- deep in the .gso_segment callback machinery, __skb_udp_tunnel_segment + tries to use the wrong inner network header, expecting the one set in + iptunnel_handle_offloads but getting the one set by xfrm instead. +- a bit later, ipv6_gso_segment accesses the wrong memory based on that + wrong inner network header. + +With the new change, the original bug (or similar ones) cannot happen +again, as xfrm will now trigger software GSO before applying a tunnel. +This concern doesn't exist in packet offload mode, when the HW adds +encapsulation headers. For the non-offloaded packets (crypto in SW), +software GSO is still done unconditionally in the else branch. + +Reviewed-by: Dragos Tatulea +Reviewed-by: Yael Chemla +Reviewed-by: Leon Romanovsky +Fixes: a204aef9fd77 ("xfrm: call xfrm_output_gso when inner_protocol is set in xfrm_output") +Signed-off-by: Cosmin Ratiu +Signed-off-by: Steffen Klassert +Signed-off-by: Sasha Levin +--- + net/xfrm/xfrm_output.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c +index ac907b9d32d1e..40f7a98abdd1c 100644 +--- a/net/xfrm/xfrm_output.c ++++ b/net/xfrm/xfrm_output.c +@@ -601,7 +601,7 @@ int xfrm_output(struct sock *sk, struct sk_buff *skb) + xfrm_state_hold(x); + + if (skb_is_gso(skb)) { +- if (skb->inner_protocol) ++ if (skb->inner_protocol && x->props.mode == XFRM_MODE_TUNNEL) + return xfrm_output_gso(net, sk, skb); + + skb_shinfo(skb)->gso_type |= SKB_GSO_ESP; +-- +2.39.5 +