From: Greg Kroah-Hartman Date: Fri, 30 Aug 2024 10:42:53 +0000 (+0200) Subject: 5.15-stable patches X-Git-Tag: v4.19.321~68 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=4fb47836e2a891423a2a8b2d005e593c1c45680a;p=thirdparty%2Fkernel%2Fstable-queue.git 5.15-stable patches added patches: mptcp-sched-check-both-backup-in-retrans.patch net-mana-fix-race-of-mana_hwc_post_rx_wqe-and-new-hwc-response.patch wifi-mwifiex-duplicate-static-structs-used-in-driver-instances.patch --- diff --git a/queue-5.15/mptcp-sched-check-both-backup-in-retrans.patch b/queue-5.15/mptcp-sched-check-both-backup-in-retrans.patch new file mode 100644 index 00000000000..ff836b5d0d8 --- /dev/null +++ b/queue-5.15/mptcp-sched-check-both-backup-in-retrans.patch @@ -0,0 +1,48 @@ +From 2a1f596ebb23eadc0f9b95a8012e18ef76295fc8 Mon Sep 17 00:00:00 2001 +From: "Matthieu Baerts (NGI0)" +Date: Mon, 26 Aug 2024 19:11:20 +0200 +Subject: mptcp: sched: check both backup in retrans + +From: Matthieu Baerts (NGI0) + +commit 2a1f596ebb23eadc0f9b95a8012e18ef76295fc8 upstream. + +The 'mptcp_subflow_context' structure has two items related to the +backup flags: + + - 'backup': the subflow has been marked as backup by the other peer + + - 'request_bkup': the backup flag has been set by the host + +Looking only at the 'backup' flag can make sense in some cases, but it +is not the behaviour of the default packet scheduler when selecting +paths. + +As explained in the commit b6a66e521a20 ("mptcp: sched: check both +directions for backup"), the packet scheduler should look at both flags, +because that was the behaviour from the beginning: the 'backup' flag was +set by accident instead of the 'request_bkup' one. Now that the latter +has been fixed, get_retrans() needs to be adapted as well. + +Fixes: b6a66e521a20 ("mptcp: sched: check both directions for backup") +Cc: stable@vger.kernel.org +Reviewed-by: Mat Martineau +Signed-off-by: Matthieu Baerts (NGI0) +Link: https://patch.msgid.link/20240826-net-mptcp-close-extra-sf-fin-v1-3-905199fe1172@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/mptcp/protocol.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/mptcp/protocol.c ++++ b/net/mptcp/protocol.c +@@ -2213,7 +2213,7 @@ static struct sock *mptcp_subflow_get_re + continue; + } + +- if (subflow->backup) { ++ if (subflow->backup || subflow->request_bkup) { + if (!backup) + backup = ssk; + continue; diff --git a/queue-5.15/net-mana-fix-race-of-mana_hwc_post_rx_wqe-and-new-hwc-response.patch b/queue-5.15/net-mana-fix-race-of-mana_hwc_post_rx_wqe-and-new-hwc-response.patch new file mode 100644 index 00000000000..725c4cf5247 --- /dev/null +++ b/queue-5.15/net-mana-fix-race-of-mana_hwc_post_rx_wqe-and-new-hwc-response.patch @@ -0,0 +1,133 @@ +From 8af174ea863c72f25ce31cee3baad8a301c0cf0f Mon Sep 17 00:00:00 2001 +From: Haiyang Zhang +Date: Wed, 21 Aug 2024 13:42:29 -0700 +Subject: net: mana: Fix race of mana_hwc_post_rx_wqe and new hwc response + +From: Haiyang Zhang + +commit 8af174ea863c72f25ce31cee3baad8a301c0cf0f upstream. + +The mana_hwc_rx_event_handler() / mana_hwc_handle_resp() calls +complete(&ctx->comp_event) before posting the wqe back. It's +possible that other callers, like mana_create_txq(), start the +next round of mana_hwc_send_request() before the posting of wqe. +And if the HW is fast enough to respond, it can hit no_wqe error +on the HW channel, then the response message is lost. The mana +driver may fail to create queues and open, because of waiting for +the HW response and timed out. +Sample dmesg: +[ 528.610840] mana 39d4:00:02.0: HWC: Request timed out! +[ 528.614452] mana 39d4:00:02.0: Failed to send mana message: -110, 0x0 +[ 528.618326] mana 39d4:00:02.0 enP14804s2: Failed to create WQ object: -110 + +To fix it, move posting of rx wqe before complete(&ctx->comp_event). + +Cc: stable@vger.kernel.org +Fixes: ca9c54d2d6a5 ("net: mana: Add a driver for Microsoft Azure Network Adapter (MANA)") +Signed-off-by: Haiyang Zhang +Reviewed-by: Long Li +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/microsoft/mana/hw_channel.c | 62 ++++++++++++----------- + 1 file changed, 34 insertions(+), 28 deletions(-) + +--- a/drivers/net/ethernet/microsoft/mana/hw_channel.c ++++ b/drivers/net/ethernet/microsoft/mana/hw_channel.c +@@ -51,9 +51,33 @@ static int mana_hwc_verify_resp_msg(cons + return 0; + } + ++static int mana_hwc_post_rx_wqe(const struct hwc_wq *hwc_rxq, ++ struct hwc_work_request *req) ++{ ++ struct device *dev = hwc_rxq->hwc->dev; ++ struct gdma_sge *sge; ++ int err; ++ ++ sge = &req->sge; ++ sge->address = (u64)req->buf_sge_addr; ++ sge->mem_key = hwc_rxq->msg_buf->gpa_mkey; ++ sge->size = req->buf_len; ++ ++ memset(&req->wqe_req, 0, sizeof(struct gdma_wqe_request)); ++ req->wqe_req.sgl = sge; ++ req->wqe_req.num_sge = 1; ++ req->wqe_req.client_data_unit = 0; ++ ++ err = mana_gd_post_and_ring(hwc_rxq->gdma_wq, &req->wqe_req, NULL); ++ if (err) ++ dev_err(dev, "Failed to post WQE on HWC RQ: %d\n", err); ++ return err; ++} ++ + static void mana_hwc_handle_resp(struct hw_channel_context *hwc, u32 resp_len, +- const struct gdma_resp_hdr *resp_msg) ++ struct hwc_work_request *rx_req) + { ++ const struct gdma_resp_hdr *resp_msg = rx_req->buf_va; + struct hwc_caller_ctx *ctx; + int err; + +@@ -61,6 +85,7 @@ static void mana_hwc_handle_resp(struct + hwc->inflight_msg_res.map)) { + dev_err(hwc->dev, "hwc_rx: invalid msg_id = %u\n", + resp_msg->response.hwc_msg_id); ++ mana_hwc_post_rx_wqe(hwc->rxq, rx_req); + return; + } + +@@ -74,30 +99,13 @@ static void mana_hwc_handle_resp(struct + memcpy(ctx->output_buf, resp_msg, resp_len); + out: + ctx->error = err; +- complete(&ctx->comp_event); +-} +- +-static int mana_hwc_post_rx_wqe(const struct hwc_wq *hwc_rxq, +- struct hwc_work_request *req) +-{ +- struct device *dev = hwc_rxq->hwc->dev; +- struct gdma_sge *sge; +- int err; +- +- sge = &req->sge; +- sge->address = (u64)req->buf_sge_addr; +- sge->mem_key = hwc_rxq->msg_buf->gpa_mkey; +- sge->size = req->buf_len; + +- memset(&req->wqe_req, 0, sizeof(struct gdma_wqe_request)); +- req->wqe_req.sgl = sge; +- req->wqe_req.num_sge = 1; +- req->wqe_req.client_data_unit = 0; ++ /* Must post rx wqe before complete(), otherwise the next rx may ++ * hit no_wqe error. ++ */ ++ mana_hwc_post_rx_wqe(hwc->rxq, rx_req); + +- err = mana_gd_post_and_ring(hwc_rxq->gdma_wq, &req->wqe_req, NULL); +- if (err) +- dev_err(dev, "Failed to post WQE on HWC RQ: %d\n", err); +- return err; ++ complete(&ctx->comp_event); + } + + static void mana_hwc_init_event_handler(void *ctx, struct gdma_queue *q_self, +@@ -208,14 +216,12 @@ static void mana_hwc_rx_event_handler(vo + return; + } + +- mana_hwc_handle_resp(hwc, rx_oob->tx_oob_data_size, resp); ++ mana_hwc_handle_resp(hwc, rx_oob->tx_oob_data_size, rx_req); + +- /* Do no longer use 'resp', because the buffer is posted to the HW +- * in the below mana_hwc_post_rx_wqe(). ++ /* Can no longer use 'resp', because the buffer is posted to the HW ++ * in mana_hwc_handle_resp() above. + */ + resp = NULL; +- +- mana_hwc_post_rx_wqe(hwc_rxq, rx_req); + } + + static void mana_hwc_tx_event_handler(void *ctx, u32 gdma_txq_id, diff --git a/queue-5.15/series b/queue-5.15/series index 558f13c1b47..aa3c8fb3fad 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -176,3 +176,6 @@ drm-amdgpu-using-uninitialized-value-size-when-calling-amdgpu_vce_cs_reloc.patch btrfs-run-delayed-iputs-when-flushing-delalloc.patch pinctrl-rockchip-correct-rk3328-iomux-width-flag-for-gpio2-b-pins.patch pinctrl-single-fix-potential-null-dereference-in-pcs_get_function.patch +wifi-mwifiex-duplicate-static-structs-used-in-driver-instances.patch +net-mana-fix-race-of-mana_hwc_post_rx_wqe-and-new-hwc-response.patch +mptcp-sched-check-both-backup-in-retrans.patch diff --git a/queue-5.15/wifi-mwifiex-duplicate-static-structs-used-in-driver-instances.patch b/queue-5.15/wifi-mwifiex-duplicate-static-structs-used-in-driver-instances.patch new file mode 100644 index 00000000000..f2ad205a8a5 --- /dev/null +++ b/queue-5.15/wifi-mwifiex-duplicate-static-structs-used-in-driver-instances.patch @@ -0,0 +1,84 @@ +From 27ec3c57fcadb43c79ed05b2ea31bc18c72d798a Mon Sep 17 00:00:00 2001 +From: Sascha Hauer +Date: Fri, 9 Aug 2024 10:11:33 +0200 +Subject: wifi: mwifiex: duplicate static structs used in driver instances + +From: Sascha Hauer + +commit 27ec3c57fcadb43c79ed05b2ea31bc18c72d798a upstream. + +mwifiex_band_2ghz and mwifiex_band_5ghz are statically allocated, but +used and modified in driver instances. Duplicate them before using +them in driver instances so that different driver instances do not +influence each other. + +This was observed on a board which has one PCIe and one SDIO mwifiex +adapter. It blew up in mwifiex_setup_ht_caps(). This was called with +the statically allocated struct which is modified in this function. + +Cc: stable@vger.kernel.org +Fixes: d6bffe8bb520 ("mwifiex: support for creation of AP interface") +Signed-off-by: Sascha Hauer +Reviewed-by: Francesco Dolcini +Acked-by: Brian Norris +Signed-off-by: Kalle Valo +Link: https://patch.msgid.link/20240809-mwifiex-duplicate-static-structs-v1-1-6837b903b1a4@pengutronix.de +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/marvell/mwifiex/cfg80211.c | 32 +++++++++++++++++++----- + 1 file changed, 26 insertions(+), 6 deletions(-) + +--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c ++++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c +@@ -4328,11 +4328,27 @@ int mwifiex_register_cfg80211(struct mwi + if (ISSUPP_ADHOC_ENABLED(adapter->fw_cap_info)) + wiphy->interface_modes |= BIT(NL80211_IFTYPE_ADHOC); + +- wiphy->bands[NL80211_BAND_2GHZ] = &mwifiex_band_2ghz; +- if (adapter->config_bands & BAND_A) +- wiphy->bands[NL80211_BAND_5GHZ] = &mwifiex_band_5ghz; +- else ++ wiphy->bands[NL80211_BAND_2GHZ] = devm_kmemdup(adapter->dev, ++ &mwifiex_band_2ghz, ++ sizeof(mwifiex_band_2ghz), ++ GFP_KERNEL); ++ if (!wiphy->bands[NL80211_BAND_2GHZ]) { ++ ret = -ENOMEM; ++ goto err; ++ } ++ ++ if (adapter->config_bands & BAND_A) { ++ wiphy->bands[NL80211_BAND_5GHZ] = devm_kmemdup(adapter->dev, ++ &mwifiex_band_5ghz, ++ sizeof(mwifiex_band_5ghz), ++ GFP_KERNEL); ++ if (!wiphy->bands[NL80211_BAND_5GHZ]) { ++ ret = -ENOMEM; ++ goto err; ++ } ++ } else { + wiphy->bands[NL80211_BAND_5GHZ] = NULL; ++ } + + if (adapter->drcs_enabled && ISSUPP_DRCS_ENABLED(adapter->fw_cap_info)) + wiphy->iface_combinations = &mwifiex_iface_comb_ap_sta_drcs; +@@ -4425,8 +4441,7 @@ int mwifiex_register_cfg80211(struct mwi + if (ret < 0) { + mwifiex_dbg(adapter, ERROR, + "%s: wiphy_register failed: %d\n", __func__, ret); +- wiphy_free(wiphy); +- return ret; ++ goto err; + } + + if (!adapter->regd) { +@@ -4468,4 +4483,9 @@ int mwifiex_register_cfg80211(struct mwi + + adapter->wiphy = wiphy; + return ret; ++ ++err: ++ wiphy_free(wiphy); ++ ++ return ret; + }