From: Sasha Levin Date: Sun, 22 Aug 2021 02:39:20 +0000 (-0400) Subject: Fixes for 4.19 X-Git-Tag: v5.13.13~20 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=4199b58b1210ea33c556dcf3e90d36652d5ed11e;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 4.19 Signed-off-by: Sasha Levin --- diff --git a/queue-4.19/bnxt-disable-napi-before-canceling-dim.patch b/queue-4.19/bnxt-disable-napi-before-canceling-dim.patch new file mode 100644 index 00000000000..a213c984467 --- /dev/null +++ b/queue-4.19/bnxt-disable-napi-before-canceling-dim.patch @@ -0,0 +1,43 @@ +From 8761dad9848ea7a651fd7bb476d8ff829aaaf2d6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Aug 2021 14:42:40 -0700 +Subject: bnxt: disable napi before canceling DIM + +From: Jakub Kicinski + +[ Upstream commit 01cca6b9330ac7460de44eeeb3a0607f8aae69ff ] + +napi schedules DIM, napi has to be disabled first, +then DIM canceled. + +Noticed while reading the code. + +Fixes: 0bc0b97fca73 ("bnxt_en: cleanup DIM work on device shutdown") +Fixes: 6a8788f25625 ("bnxt_en: add support for software dynamic interrupt moderation") +Reviewed-by: Michael Chan +Reviewed-by: Edwin Peer +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index c4ddd8f71b93..55827ac65a15 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -6269,10 +6269,9 @@ static void bnxt_disable_napi(struct bnxt *bp) + for (i = 0; i < bp->cp_nr_rings; i++) { + struct bnxt_cp_ring_info *cpr = &bp->bnapi[i]->cp_ring; + ++ napi_disable(&bp->bnapi[i]->napi); + if (bp->bnapi[i]->rx_ring) + cancel_work_sync(&cpr->dim.work); +- +- napi_disable(&bp->bnapi[i]->napi); + } + } + +-- +2.30.2 + diff --git a/queue-4.19/bnxt-don-t-lock-the-tx-queue-from-napi-poll.patch b/queue-4.19/bnxt-don-t-lock-the-tx-queue-from-napi-poll.patch new file mode 100644 index 00000000000..ede08a1dad1 --- /dev/null +++ b/queue-4.19/bnxt-don-t-lock-the-tx-queue-from-napi-poll.patch @@ -0,0 +1,141 @@ +From 39ea63cabf35a7f44139d7dc0155c0bec44e4fde Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Aug 2021 14:42:39 -0700 +Subject: bnxt: don't lock the tx queue from napi poll + +From: Jakub Kicinski + +[ Upstream commit 3c603136c9f82833813af77185618de5af67676c ] + +We can't take the tx lock from the napi poll routine, because +netpoll can poll napi at any moment, including with the tx lock +already held. + +The tx lock is protecting against two paths - the disable +path, and (as Michael points out) the NETDEV_TX_BUSY case +which may occur if NAPI completions race with start_xmit +and both decide to re-enable the queue. + +For the disable/ifdown path use synchronize_net() to make sure +closing the device does not race we restarting the queues. +Annotate accesses to dev_state against data races. + +For the NAPI cleanup vs start_xmit path - appropriate barriers +are already in place in the main spot where Tx queue is stopped +but we need to do the same careful dance in the TX_BUSY case. + +Fixes: c0c050c58d84 ("bnxt_en: New Broadcom ethernet driver.") +Reviewed-by: Michael Chan +Reviewed-by: Edwin Peer +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 54 ++++++++++++++--------- + 1 file changed, 32 insertions(+), 22 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index ebcf4ea66385..c4ddd8f71b93 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -282,6 +282,26 @@ static u16 bnxt_xmit_get_cfa_action(struct sk_buff *skb) + return md_dst->u.port_info.port_id; + } + ++static bool bnxt_txr_netif_try_stop_queue(struct bnxt *bp, ++ struct bnxt_tx_ring_info *txr, ++ struct netdev_queue *txq) ++{ ++ netif_tx_stop_queue(txq); ++ ++ /* netif_tx_stop_queue() must be done before checking ++ * tx index in bnxt_tx_avail() below, because in ++ * bnxt_tx_int(), we update tx index before checking for ++ * netif_tx_queue_stopped(). ++ */ ++ smp_mb(); ++ if (bnxt_tx_avail(bp, txr) > bp->tx_wake_thresh) { ++ netif_tx_wake_queue(txq); ++ return false; ++ } ++ ++ return true; ++} ++ + static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev) + { + struct bnxt *bp = netdev_priv(dev); +@@ -309,8 +329,8 @@ static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev) + + free_size = bnxt_tx_avail(bp, txr); + if (unlikely(free_size < skb_shinfo(skb)->nr_frags + 2)) { +- netif_tx_stop_queue(txq); +- return NETDEV_TX_BUSY; ++ if (bnxt_txr_netif_try_stop_queue(bp, txr, txq)) ++ return NETDEV_TX_BUSY; + } + + length = skb->len; +@@ -521,16 +541,7 @@ tx_done: + if (skb->xmit_more && !tx_buf->is_push) + bnxt_db_write(bp, txr->tx_doorbell, DB_KEY_TX | prod); + +- netif_tx_stop_queue(txq); +- +- /* netif_tx_stop_queue() must be done before checking +- * tx index in bnxt_tx_avail() below, because in +- * bnxt_tx_int(), we update tx index before checking for +- * netif_tx_queue_stopped(). +- */ +- smp_mb(); +- if (bnxt_tx_avail(bp, txr) > bp->tx_wake_thresh) +- netif_tx_wake_queue(txq); ++ bnxt_txr_netif_try_stop_queue(bp, txr, txq); + } + return NETDEV_TX_OK; + +@@ -614,14 +625,9 @@ next_tx_int: + smp_mb(); + + if (unlikely(netif_tx_queue_stopped(txq)) && +- (bnxt_tx_avail(bp, txr) > bp->tx_wake_thresh)) { +- __netif_tx_lock(txq, smp_processor_id()); +- if (netif_tx_queue_stopped(txq) && +- bnxt_tx_avail(bp, txr) > bp->tx_wake_thresh && +- txr->dev_state != BNXT_DEV_STATE_CLOSING) +- netif_tx_wake_queue(txq); +- __netif_tx_unlock(txq); +- } ++ bnxt_tx_avail(bp, txr) > bp->tx_wake_thresh && ++ READ_ONCE(txr->dev_state) != BNXT_DEV_STATE_CLOSING) ++ netif_tx_wake_queue(txq); + } + + static struct page *__bnxt_alloc_rx_page(struct bnxt *bp, dma_addr_t *mapping, +@@ -6294,9 +6300,11 @@ void bnxt_tx_disable(struct bnxt *bp) + if (bp->tx_ring) { + for (i = 0; i < bp->tx_nr_rings; i++) { + txr = &bp->tx_ring[i]; +- txr->dev_state = BNXT_DEV_STATE_CLOSING; ++ WRITE_ONCE(txr->dev_state, BNXT_DEV_STATE_CLOSING); + } + } ++ /* Make sure napi polls see @dev_state change */ ++ synchronize_net(); + /* Drop carrier first to prevent TX timeout */ + netif_carrier_off(bp->dev); + /* Stop all TX queues */ +@@ -6310,8 +6318,10 @@ void bnxt_tx_enable(struct bnxt *bp) + + for (i = 0; i < bp->tx_nr_rings; i++) { + txr = &bp->tx_ring[i]; +- txr->dev_state = 0; ++ WRITE_ONCE(txr->dev_state, 0); + } ++ /* Make sure napi polls see @dev_state change */ ++ synchronize_net(); + netif_tx_wake_all_queues(bp->dev); + if (bp->link_info.link_up) + netif_carrier_on(bp->dev); +-- +2.30.2 + diff --git a/queue-4.19/cpufreq-armada-37xx-forbid-cpufreq-for-1.2-ghz-varia.patch b/queue-4.19/cpufreq-armada-37xx-forbid-cpufreq-for-1.2-ghz-varia.patch new file mode 100644 index 00000000000..5cc2e442d9f --- /dev/null +++ b/queue-4.19/cpufreq-armada-37xx-forbid-cpufreq-for-1.2-ghz-varia.patch @@ -0,0 +1,54 @@ +From f7ff95de4602d5d9325bca68a16eb10603d7b11d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Jul 2021 00:56:01 +0200 +Subject: cpufreq: armada-37xx: forbid cpufreq for 1.2 GHz variant +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Marek Behún + +[ Upstream commit 484f2b7c61b9ae58cc00c5127bcbcd9177af8dfe ] + +The 1.2 GHz variant of the Armada 3720 SOC is unstable with DVFS: when +the SOC boots, the WTMI firmware sets clocks and AVS values that work +correctly with 1.2 GHz CPU frequency, but random crashes occur once +cpufreq driver starts scaling. + +We do not know currently what is the reason: +- it may be that the voltage value for L0 for 1.2 GHz variant provided + by the vendor in the OTP is simply incorrect when scaling is used, +- it may be that some delay is needed somewhere, +- it may be something else. + +The most sane solution now seems to be to simply forbid the cpufreq +driver on 1.2 GHz variant. + +Signed-off-by: Marek Behún +Fixes: 92ce45fb875d ("cpufreq: Add DVFS support for Armada 37xx") +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/armada-37xx-cpufreq.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/cpufreq/armada-37xx-cpufreq.c b/drivers/cpufreq/armada-37xx-cpufreq.c +index a36452bd9612..31b5655419b4 100644 +--- a/drivers/cpufreq/armada-37xx-cpufreq.c ++++ b/drivers/cpufreq/armada-37xx-cpufreq.c +@@ -102,7 +102,11 @@ struct armada_37xx_dvfs { + }; + + static struct armada_37xx_dvfs armada_37xx_dvfs[] = { +- {.cpu_freq_max = 1200*1000*1000, .divider = {1, 2, 4, 6} }, ++ /* ++ * The cpufreq scaling for 1.2 GHz variant of the SOC is currently ++ * unstable because we do not know how to configure it properly. ++ */ ++ /* {.cpu_freq_max = 1200*1000*1000, .divider = {1, 2, 4, 6} }, */ + {.cpu_freq_max = 1000*1000*1000, .divider = {1, 2, 4, 5} }, + {.cpu_freq_max = 800*1000*1000, .divider = {1, 2, 3, 4} }, + {.cpu_freq_max = 600*1000*1000, .divider = {2, 4, 5, 6} }, +-- +2.30.2 + diff --git a/queue-4.19/dccp-add-do-while-0-stubs-for-dccp_pr_debug-macros.patch b/queue-4.19/dccp-add-do-while-0-stubs-for-dccp_pr_debug-macros.patch new file mode 100644 index 00000000000..68d3914981e --- /dev/null +++ b/queue-4.19/dccp-add-do-while-0-stubs-for-dccp_pr_debug-macros.patch @@ -0,0 +1,54 @@ +From aec3f026776a07e9633c3be9908f9f7ac96a13f1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 8 Aug 2021 16:04:40 -0700 +Subject: dccp: add do-while-0 stubs for dccp_pr_debug macros + +From: Randy Dunlap + +[ Upstream commit 86aab09a4870bb8346c9579864588c3d7f555299 ] + +GCC complains about empty macros in an 'if' statement, so convert +them to 'do {} while (0)' macros. + +Fixes these build warnings: + +net/dccp/output.c: In function 'dccp_xmit_packet': +../net/dccp/output.c:283:71: warning: suggest braces around empty body in an 'if' statement [-Wempty-body] + 283 | dccp_pr_debug("transmit_skb() returned err=%d\n", err); +net/dccp/ackvec.c: In function 'dccp_ackvec_update_old': +../net/dccp/ackvec.c:163:80: warning: suggest braces around empty body in an 'else' statement [-Wempty-body] + 163 | (unsigned long long)seqno, state); + +Fixes: dc841e30eaea ("dccp: Extend CCID packet dequeueing interface") +Fixes: 380240864451 ("dccp ccid-2: Update code for the Ack Vector input/registration routine") +Signed-off-by: Randy Dunlap +Cc: dccp@vger.kernel.org +Cc: "David S. Miller" +Cc: Jakub Kicinski +Cc: Gerrit Renker +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/dccp/dccp.h | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/net/dccp/dccp.h b/net/dccp/dccp.h +index f91e3816806b..aec3c724665f 100644 +--- a/net/dccp/dccp.h ++++ b/net/dccp/dccp.h +@@ -44,9 +44,9 @@ extern bool dccp_debug; + #define dccp_pr_debug_cat(format, a...) DCCP_PRINTK(dccp_debug, format, ##a) + #define dccp_debug(fmt, a...) dccp_pr_debug_cat(KERN_DEBUG fmt, ##a) + #else +-#define dccp_pr_debug(format, a...) +-#define dccp_pr_debug_cat(format, a...) +-#define dccp_debug(format, a...) ++#define dccp_pr_debug(format, a...) do {} while (0) ++#define dccp_pr_debug_cat(format, a...) do {} while (0) ++#define dccp_debug(format, a...) do {} while (0) + #endif + + extern struct inet_hashinfo dccp_hashinfo; +-- +2.30.2 + diff --git a/queue-4.19/net-6pack-fix-slab-out-of-bounds-in-decode_data.patch b/queue-4.19/net-6pack-fix-slab-out-of-bounds-in-decode_data.patch new file mode 100644 index 00000000000..9e3ac0a0511 --- /dev/null +++ b/queue-4.19/net-6pack-fix-slab-out-of-bounds-in-decode_data.patch @@ -0,0 +1,67 @@ +From 87b21082e13e1aa6b72e27a03021f536a2f3aa07 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Aug 2021 18:14:33 +0300 +Subject: net: 6pack: fix slab-out-of-bounds in decode_data + +From: Pavel Skripkin + +[ Upstream commit 19d1532a187669ce86d5a2696eb7275310070793 ] + +Syzbot reported slab-out-of bounds write in decode_data(). +The problem was in missing validation checks. + +Syzbot's reproducer generated malicious input, which caused +decode_data() to be called a lot in sixpack_decode(). Since +rx_count_cooked is only 400 bytes and noone reported before, +that 400 bytes is not enough, let's just check if input is malicious +and complain about buffer overrun. + +Fail log: +================================================================== +BUG: KASAN: slab-out-of-bounds in drivers/net/hamradio/6pack.c:843 +Write of size 1 at addr ffff888087c5544e by task kworker/u4:0/7 + +CPU: 0 PID: 7 Comm: kworker/u4:0 Not tainted 5.6.0-rc3-syzkaller #0 +... +Workqueue: events_unbound flush_to_ldisc +Call Trace: + __dump_stack lib/dump_stack.c:77 [inline] + dump_stack+0x197/0x210 lib/dump_stack.c:118 + print_address_description.constprop.0.cold+0xd4/0x30b mm/kasan/report.c:374 + __kasan_report.cold+0x1b/0x32 mm/kasan/report.c:506 + kasan_report+0x12/0x20 mm/kasan/common.c:641 + __asan_report_store1_noabort+0x17/0x20 mm/kasan/generic_report.c:137 + decode_data.part.0+0x23b/0x270 drivers/net/hamradio/6pack.c:843 + decode_data drivers/net/hamradio/6pack.c:965 [inline] + sixpack_decode drivers/net/hamradio/6pack.c:968 [inline] + +Reported-and-tested-by: syzbot+fc8cd9a673d4577fb2e4@syzkaller.appspotmail.com +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Pavel Skripkin +Reviewed-by: Dan Carpenter +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/hamradio/6pack.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c +index 8c636c493227..1001e9a2edd4 100644 +--- a/drivers/net/hamradio/6pack.c ++++ b/drivers/net/hamradio/6pack.c +@@ -859,6 +859,12 @@ static void decode_data(struct sixpack *sp, unsigned char inbyte) + return; + } + ++ if (sp->rx_count_cooked + 2 >= sizeof(sp->cooked_buf)) { ++ pr_err("6pack: cooked buffer overrun, data loss\n"); ++ sp->rx_count = 0; ++ return; ++ } ++ + buf = sp->raw_buf; + sp->cooked_buf[sp->rx_count_cooked++] = + buf[0] | ((buf[1] << 2) & 0xc0); +-- +2.30.2 + diff --git a/queue-4.19/net-mdio-mux-don-t-ignore-memory-allocation-errors.patch b/queue-4.19/net-mdio-mux-don-t-ignore-memory-allocation-errors.patch new file mode 100644 index 00000000000..29d9402f4a7 --- /dev/null +++ b/queue-4.19/net-mdio-mux-don-t-ignore-memory-allocation-errors.patch @@ -0,0 +1,96 @@ +From 2f9bac309f8ec6d56d1d4908b8308c5afa40301e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Aug 2021 20:38:02 -0700 +Subject: net: mdio-mux: Don't ignore memory allocation errors + +From: Saravana Kannan + +[ Upstream commit 99d81e942474cc7677d12f673f42a7ea699e2589 ] + +If we are seeing memory allocation errors, don't try to continue +registering child mdiobus devices. It's unlikely they'll succeed. + +Fixes: 342fa1964439 ("mdio: mux: make child bus walking more permissive and errors more verbose") +Signed-off-by: Saravana Kannan +Reviewed-by: Andrew Lunn +Acked-by: Marc Zyngier +Tested-by: Marc Zyngier +Acked-by: Kevin Hilman +Tested-by: Kevin Hilman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/phy/mdio-mux.c | 28 ++++++++++++++++++---------- + 1 file changed, 18 insertions(+), 10 deletions(-) + +diff --git a/drivers/net/phy/mdio-mux.c b/drivers/net/phy/mdio-mux.c +index 0a86f1e4c02f..bb7e3f12a003 100644 +--- a/drivers/net/phy/mdio-mux.c ++++ b/drivers/net/phy/mdio-mux.c +@@ -85,6 +85,17 @@ out: + + static int parent_count; + ++static void mdio_mux_uninit_children(struct mdio_mux_parent_bus *pb) ++{ ++ struct mdio_mux_child_bus *cb = pb->children; ++ ++ while (cb) { ++ mdiobus_unregister(cb->mii_bus); ++ mdiobus_free(cb->mii_bus); ++ cb = cb->next; ++ } ++} ++ + int mdio_mux_init(struct device *dev, + struct device_node *mux_node, + int (*switch_fn)(int cur, int desired, void *data), +@@ -147,7 +158,7 @@ int mdio_mux_init(struct device *dev, + cb = devm_kzalloc(dev, sizeof(*cb), GFP_KERNEL); + if (!cb) { + ret_val = -ENOMEM; +- continue; ++ goto err_loop; + } + cb->bus_number = v; + cb->parent = pb; +@@ -155,8 +166,7 @@ int mdio_mux_init(struct device *dev, + cb->mii_bus = mdiobus_alloc(); + if (!cb->mii_bus) { + ret_val = -ENOMEM; +- devm_kfree(dev, cb); +- continue; ++ goto err_loop; + } + cb->mii_bus->priv = cb; + +@@ -185,6 +195,10 @@ int mdio_mux_init(struct device *dev, + + dev_err(dev, "Error: No acceptable child buses found\n"); + devm_kfree(dev, pb); ++ ++err_loop: ++ mdio_mux_uninit_children(pb); ++ of_node_put(child_bus_node); + err_pb_kz: + put_device(&parent_bus->dev); + err_parent_bus: +@@ -196,14 +210,8 @@ EXPORT_SYMBOL_GPL(mdio_mux_init); + void mdio_mux_uninit(void *mux_handle) + { + struct mdio_mux_parent_bus *pb = mux_handle; +- struct mdio_mux_child_bus *cb = pb->children; +- +- while (cb) { +- mdiobus_unregister(cb->mii_bus); +- mdiobus_free(cb->mii_bus); +- cb = cb->next; +- } + ++ mdio_mux_uninit_children(pb); + put_device(&pb->mii_bus->dev); + } + EXPORT_SYMBOL_GPL(mdio_mux_uninit); +-- +2.30.2 + diff --git a/queue-4.19/net-mdio-mux-handle-eprobe_defer-correctly.patch b/queue-4.19/net-mdio-mux-handle-eprobe_defer-correctly.patch new file mode 100644 index 00000000000..3aaf8338da8 --- /dev/null +++ b/queue-4.19/net-mdio-mux-handle-eprobe_defer-correctly.patch @@ -0,0 +1,58 @@ +From 20251e7211b1f36f98a1ad53513e0c4ef0fdce66 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Aug 2021 20:38:03 -0700 +Subject: net: mdio-mux: Handle -EPROBE_DEFER correctly + +From: Saravana Kannan + +[ Upstream commit 7bd0cef5dac685f09ef8b0b2a7748ff42d284dc7 ] + +When registering mdiobus children, if we get an -EPROBE_DEFER, we shouldn't +ignore it and continue registering the rest of the mdiobus children. This +would permanently prevent the deferring child mdiobus from working instead +of reattempting it in the future. So, if a child mdiobus needs to be +reattempted in the future, defer the entire mdio-mux initialization. + +This fixes the issue where PHYs sitting under the mdio-mux aren't +initialized correctly if the PHY's interrupt controller is not yet ready +when the mdio-mux is being probed. Additional context in the link below. + +Fixes: 0ca2997d1452 ("netdev/of/phy: Add MDIO bus multiplexer support.") +Link: https://lore.kernel.org/lkml/CAGETcx95kHrv8wA-O+-JtfH7H9biJEGJtijuPVN0V5dUKUAB3A@mail.gmail.com/#t +Signed-off-by: Saravana Kannan +Reviewed-by: Andrew Lunn +Acked-by: Marc Zyngier +Tested-by: Marc Zyngier +Acked-by: Kevin Hilman +Tested-by: Kevin Hilman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/phy/mdio-mux.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/phy/mdio-mux.c b/drivers/net/phy/mdio-mux.c +index bb7e3f12a003..c16f875ed9ea 100644 +--- a/drivers/net/phy/mdio-mux.c ++++ b/drivers/net/phy/mdio-mux.c +@@ -178,11 +178,15 @@ int mdio_mux_init(struct device *dev, + cb->mii_bus->write = mdio_mux_write; + r = of_mdiobus_register(cb->mii_bus, child_bus_node); + if (r) { ++ mdiobus_free(cb->mii_bus); ++ if (r == -EPROBE_DEFER) { ++ ret_val = r; ++ goto err_loop; ++ } ++ devm_kfree(dev, cb); + dev_err(dev, + "Error: Failed to register MDIO bus for child %pOF\n", + child_bus_node); +- mdiobus_free(cb->mii_bus); +- devm_kfree(dev, cb); + } else { + cb->next = pb->children; + pb->children = cb; +-- +2.30.2 + diff --git a/queue-4.19/net-qlcnic-add-missed-unlock-in-qlcnic_83xx_flash_re.patch b/queue-4.19/net-qlcnic-add-missed-unlock-in-qlcnic_83xx_flash_re.patch new file mode 100644 index 00000000000..9e35f7e4cf9 --- /dev/null +++ b/queue-4.19/net-qlcnic-add-missed-unlock-in-qlcnic_83xx_flash_re.patch @@ -0,0 +1,42 @@ +From 0dba1ce7a511074e240c262d1ece9e4db2ea4b48 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Aug 2021 21:14:04 +0800 +Subject: net: qlcnic: add missed unlock in qlcnic_83xx_flash_read32 + +From: Dinghao Liu + +[ Upstream commit 0a298d133893c72c96e2156ed7cb0f0c4a306a3e ] + +qlcnic_83xx_unlock_flash() is called on all paths after we call +qlcnic_83xx_lock_flash(), except for one error path on failure +of QLCRD32(), which may cause a deadlock. This bug is suggested +by a static analysis tool, please advise. + +Fixes: 81d0aeb0a4fff ("qlcnic: flash template based firmware reset recovery") +Signed-off-by: Dinghao Liu +Link: https://lore.kernel.org/r/20210816131405.24024-1-dinghao.liu@zju.edu.cn +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c +index 6ed8294f7df8..a15845e511b2 100644 +--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c ++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c +@@ -3158,8 +3158,10 @@ int qlcnic_83xx_flash_read32(struct qlcnic_adapter *adapter, u32 flash_addr, + + indirect_addr = QLC_83XX_FLASH_DIRECT_DATA(addr); + ret = QLCRD32(adapter, indirect_addr, &err); +- if (err == -EIO) ++ if (err == -EIO) { ++ qlcnic_83xx_unlock_flash(adapter); + return err; ++ } + + word = ret; + *(u32 *)p_data = word; +-- +2.30.2 + diff --git a/queue-4.19/ptp_pch-restore-dependency-on-pci.patch b/queue-4.19/ptp_pch-restore-dependency-on-pci.patch new file mode 100644 index 00000000000..239e9ee5f1f --- /dev/null +++ b/queue-4.19/ptp_pch-restore-dependency-on-pci.patch @@ -0,0 +1,38 @@ +From 1d057efffad56c6e4cae9e0869d3d780542a78f2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Aug 2021 20:33:27 +0300 +Subject: ptp_pch: Restore dependency on PCI + +From: Andy Shevchenko + +[ Upstream commit 55c8fca1dae1fb0d11deaa21b65a647dedb1bc50 ] + +During the swap dependency on PCH_GBE to selection PTP_1588_CLOCK_PCH +incidentally dropped the implicit dependency on the PCI. Restore it. + +Fixes: 18d359ceb044 ("pch_gbe, ptp_pch: Fix the dependency direction between these drivers") +Reported-by: kernel test robot +Signed-off-by: Andy Shevchenko +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/ptp/Kconfig | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/ptp/Kconfig b/drivers/ptp/Kconfig +index d137c480db46..dd04aedd76e0 100644 +--- a/drivers/ptp/Kconfig ++++ b/drivers/ptp/Kconfig +@@ -91,7 +91,8 @@ config DP83640_PHY + config PTP_1588_CLOCK_PCH + tristate "Intel PCH EG20T as PTP clock" + depends on X86_32 || COMPILE_TEST +- depends on HAS_IOMEM && NET ++ depends on HAS_IOMEM && PCI ++ depends on NET + imply PTP_1588_CLOCK + help + This driver adds support for using the PCH EG20T as a PTP +-- +2.30.2 + diff --git a/queue-4.19/series b/queue-4.19/series index 542bf668b99..33e2c9ab6b3 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -57,3 +57,13 @@ scsi-core-avoid-printing-an-error-if-target_alloc-re.patch arm-dts-nomadik-fix-up-interrupt-controller-node-nam.patch net-usb-lan78xx-don-t-modify-phy_device-state-concur.patch bluetooth-hidp-use-correct-wait-queue-when-removing-.patch +cpufreq-armada-37xx-forbid-cpufreq-for-1.2-ghz-varia.patch +dccp-add-do-while-0-stubs-for-dccp_pr_debug-macros.patch +vhost-fix-the-calculation-in-vhost_overflow.patch +bnxt-don-t-lock-the-tx-queue-from-napi-poll.patch +bnxt-disable-napi-before-canceling-dim.patch +net-6pack-fix-slab-out-of-bounds-in-decode_data.patch +ptp_pch-restore-dependency-on-pci.patch +net-qlcnic-add-missed-unlock-in-qlcnic_83xx_flash_re.patch +net-mdio-mux-don-t-ignore-memory-allocation-errors.patch +net-mdio-mux-handle-eprobe_defer-correctly.patch diff --git a/queue-4.19/vhost-fix-the-calculation-in-vhost_overflow.patch b/queue-4.19/vhost-fix-the-calculation-in-vhost_overflow.patch new file mode 100644 index 00000000000..09c50a2640b --- /dev/null +++ b/queue-4.19/vhost-fix-the-calculation-in-vhost_overflow.patch @@ -0,0 +1,49 @@ +From 3abeab325fe8bd33f8b7a3ebac4fa424f9dfc5b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Jul 2021 21:07:56 +0800 +Subject: vhost: Fix the calculation in vhost_overflow() + +From: Xie Yongji + +[ Upstream commit f7ad318ea0ad58ebe0e595e59aed270bb643b29b ] + +This fixes the incorrect calculation for integer overflow +when the last address of iova range is 0xffffffff. + +Fixes: ec33d031a14b ("vhost: detect 32 bit integer wrap around") +Reported-by: Jason Wang +Signed-off-by: Xie Yongji +Acked-by: Jason Wang +Link: https://lore.kernel.org/r/20210728130756.97-2-xieyongji@bytedance.com +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Sasha Levin +--- + drivers/vhost/vhost.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c +index 732327756ee1..7a58f629155d 100644 +--- a/drivers/vhost/vhost.c ++++ b/drivers/vhost/vhost.c +@@ -678,10 +678,16 @@ static bool log_access_ok(void __user *log_base, u64 addr, unsigned long sz) + (sz + VHOST_PAGE_SIZE * 8 - 1) / VHOST_PAGE_SIZE / 8); + } + ++/* Make sure 64 bit math will not overflow. */ + static bool vhost_overflow(u64 uaddr, u64 size) + { +- /* Make sure 64 bit math will not overflow. */ +- return uaddr > ULONG_MAX || size > ULONG_MAX || uaddr > ULONG_MAX - size; ++ if (uaddr > ULONG_MAX || size > ULONG_MAX) ++ return true; ++ ++ if (!size) ++ return false; ++ ++ return uaddr > ULONG_MAX - size + 1; + } + + /* Caller should have vq mutex and device mutex. */ +-- +2.30.2 +