From: Sasha Levin Date: Sat, 28 Oct 2023 02:53:54 +0000 (-0400) Subject: Fixes for 4.14 X-Git-Tag: v6.1.61~62 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=5ccfd989899b0ffc478d5b0228339b6a11840a2c;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 4.14 Signed-off-by: Sasha Levin --- diff --git a/queue-4.14/gtp-uapi-fix-gtpa_max.patch b/queue-4.14/gtp-uapi-fix-gtpa_max.patch new file mode 100644 index 00000000000..476c753bb33 --- /dev/null +++ b/queue-4.14/gtp-uapi-fix-gtpa_max.patch @@ -0,0 +1,34 @@ +From 311f6cbb86ecc8a5010d26bb437871f5e771d0be Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 22 Oct 2023 22:25:17 +0200 +Subject: gtp: uapi: fix GTPA_MAX + +From: Pablo Neira Ayuso + +[ Upstream commit adc8df12d91a2b8350b0cd4c7fec3e8546c9d1f8 ] + +Subtract one to __GTPA_MAX, otherwise GTPA_MAX is off by 2. + +Fixes: 459aa660eb1d ("gtp: add initial driver for datapath of GPRS Tunneling Protocol (GTP-U)") +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + include/uapi/linux/gtp.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/uapi/linux/gtp.h b/include/uapi/linux/gtp.h +index c7d66755d212b..78bd62014efd3 100644 +--- a/include/uapi/linux/gtp.h ++++ b/include/uapi/linux/gtp.h +@@ -30,6 +30,6 @@ enum gtp_attrs { + GTPA_PAD, + __GTPA_MAX, + }; +-#define GTPA_MAX (__GTPA_MAX + 1) ++#define GTPA_MAX (__GTPA_MAX - 1) + + #endif /* _UAPI_LINUX_GTP_H_ */ +-- +2.42.0 + diff --git a/queue-4.14/i40e-fix-wrong-check-for-i40e_txr_flags_wb_on_itr.patch b/queue-4.14/i40e-fix-wrong-check-for-i40e_txr_flags_wb_on_itr.patch new file mode 100644 index 00000000000..34c31029cfe --- /dev/null +++ b/queue-4.14/i40e-fix-wrong-check-for-i40e_txr_flags_wb_on_itr.patch @@ -0,0 +1,38 @@ +From 2d19e4697f01f1d04d3a2604747e50c5d301b749 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 Oct 2023 14:27:14 -0700 +Subject: i40e: Fix wrong check for I40E_TXR_FLAGS_WB_ON_ITR + +From: Ivan Vecera + +[ Upstream commit 77a8c982ff0d4c3a14022c6fe9e3dbfb327552ec ] + +The I40E_TXR_FLAGS_WB_ON_ITR is i40e_ring flag and not i40e_pf one. + +Fixes: 8e0764b4d6be42 ("i40e/i40evf: Add support for writeback on ITR feature for X722") +Signed-off-by: Ivan Vecera +Tested-by: Pucha Himasekhar Reddy (A Contingent worker at Intel) +Signed-off-by: Jacob Keller +Link: https://lore.kernel.org/r/20231023212714.178032-1-jacob.e.keller@intel.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_txrx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.c b/drivers/net/ethernet/intel/i40e/i40e_txrx.c +index d79a2c8175c4c..02871e0e20249 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c +@@ -2401,7 +2401,7 @@ int i40e_napi_poll(struct napi_struct *napi, int budget) + return budget; + } + +- if (vsi->back->flags & I40E_TXR_FLAGS_WB_ON_ITR) ++ if (q_vector->tx.ring[0].flags & I40E_TXR_FLAGS_WB_ON_ITR) + q_vector->arm_wb_state = false; + + /* Work is done so exit the polling mode and re-enable the interrupt */ +-- +2.42.0 + diff --git a/queue-4.14/igb-fix-potential-memory-leak-in-igb_add_ethtool_nfc.patch b/queue-4.14/igb-fix-potential-memory-leak-in-igb_add_ethtool_nfc.patch new file mode 100644 index 00000000000..0b350ea6b42 --- /dev/null +++ b/queue-4.14/igb-fix-potential-memory-leak-in-igb_add_ethtool_nfc.patch @@ -0,0 +1,47 @@ +From c615dc79709e40d45ec3369b12916695260ce48b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Oct 2023 13:40:35 -0700 +Subject: igb: Fix potential memory leak in igb_add_ethtool_nfc_entry + +From: Mateusz Palczewski + +[ Upstream commit 8c0b48e01daba5ca58f939a8425855d3f4f2ed14 ] + +Add check for return of igb_update_ethtool_nfc_entry so that in case +of any potential errors the memory alocated for input will be freed. + +Fixes: 0e71def25281 ("igb: add support of RX network flow classification") +Reviewed-by: Wojciech Drewek +Signed-off-by: Mateusz Palczewski +Tested-by: Arpana Arland (A Contingent worker at Intel) +Signed-off-by: Jacob Keller +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/igb/igb_ethtool.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/igb/igb_ethtool.c b/drivers/net/ethernet/intel/igb/igb_ethtool.c +index 77108b0a07f51..c8b5650b7eac5 100644 +--- a/drivers/net/ethernet/intel/igb/igb_ethtool.c ++++ b/drivers/net/ethernet/intel/igb/igb_ethtool.c +@@ -2951,11 +2951,15 @@ static int igb_add_ethtool_nfc_entry(struct igb_adapter *adapter, + if (err) + goto err_out_w_lock; + +- igb_update_ethtool_nfc_entry(adapter, input, input->sw_idx); ++ err = igb_update_ethtool_nfc_entry(adapter, input, input->sw_idx); ++ if (err) ++ goto err_out_input_filter; + + spin_unlock(&adapter->nfc_lock); + return 0; + ++err_out_input_filter: ++ igb_erase_filter(adapter, input); + err_out_w_lock: + spin_unlock(&adapter->nfc_lock); + err_out: +-- +2.42.0 + diff --git a/queue-4.14/r8152-increase-usb-control-msg-timeout-to-5000ms-as-.patch b/queue-4.14/r8152-increase-usb-control-msg-timeout-to-5000ms-as-.patch new file mode 100644 index 00000000000..a4d4423359f --- /dev/null +++ b/queue-4.14/r8152-increase-usb-control-msg-timeout-to-5000ms-as-.patch @@ -0,0 +1,77 @@ +From 71c7429f8f4b63ca3aebe8a2e66eedb5492ea4ef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Oct 2023 14:06:52 -0700 +Subject: r8152: Increase USB control msg timeout to 5000ms as per spec + +From: Douglas Anderson + +[ Upstream commit a5feba71ec9c14a54c3babdc732c5b6866d8ee43 ] + +According to the comment next to USB_CTRL_GET_TIMEOUT and +USB_CTRL_SET_TIMEOUT, although sending/receiving control messages is +usually quite fast, the spec allows them to take up to 5 seconds. +Let's increase the timeout in the Realtek driver from 500ms to 5000ms +(using the #defines) to account for this. + +This is not just a theoretical change. The need for the longer timeout +was seen in testing. Specifically, if you drop a sc7180-trogdor based +Chromebook into the kdb debugger and then "go" again after sitting in +the debugger for a while, the next USB control message takes a long +time. Out of ~40 tests the slowest USB control message was 4.5 +seconds. + +While dropping into kdb is not exactly an end-user scenario, the above +is similar to what could happen due to an temporary interrupt storm, +what could happen if there was a host controller (HW or SW) issue, or +what could happen if the Realtek device got into a confused state and +needed time to recover. + +This change is fairly critical since the r8152 driver in Linux doesn't +expect register reads/writes (which are backed by USB control +messages) to fail. + +Fixes: ac718b69301c ("net/usb: new driver for RTL8152") +Suggested-by: Hayes Wang +Signed-off-by: Douglas Anderson +Reviewed-by: Grant Grundler +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/usb/r8152.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c +index d17d125a34540..a0b40bdbdd84f 100644 +--- a/drivers/net/usb/r8152.c ++++ b/drivers/net/usb/r8152.c +@@ -786,7 +786,7 @@ int get_registers(struct r8152 *tp, u16 value, u16 index, u16 size, void *data) + + ret = usb_control_msg(tp->udev, usb_rcvctrlpipe(tp->udev, 0), + RTL8152_REQ_GET_REGS, RTL8152_REQT_READ, +- value, index, tmp, size, 500); ++ value, index, tmp, size, USB_CTRL_GET_TIMEOUT); + if (ret < 0) + memset(data, 0xff, size); + else +@@ -809,7 +809,7 @@ int set_registers(struct r8152 *tp, u16 value, u16 index, u16 size, void *data) + + ret = usb_control_msg(tp->udev, usb_sndctrlpipe(tp->udev, 0), + RTL8152_REQ_SET_REGS, RTL8152_REQT_WRITE, +- value, index, tmp, size, 500); ++ value, index, tmp, size, USB_CTRL_SET_TIMEOUT); + + kfree(tmp); + +@@ -5084,7 +5084,8 @@ static u8 rtl_get_version(struct usb_interface *intf) + + ret = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0), + RTL8152_REQ_GET_REGS, RTL8152_REQT_READ, +- PLA_TCR0, MCU_TYPE_PLA, tmp, sizeof(*tmp), 500); ++ PLA_TCR0, MCU_TYPE_PLA, tmp, sizeof(*tmp), ++ USB_CTRL_GET_TIMEOUT); + if (ret > 0) + ocp_data = (__le32_to_cpu(*tmp) >> 16) & VERSION_MASK; + +-- +2.42.0 + diff --git a/queue-4.14/series b/queue-4.14/series index 004b6f583d2..c96dc5c0275 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -1,3 +1,9 @@ mcb-return-actual-parsed-size-when-reading-chameleon.patch mcb-lpc-reallocate-memory-region-to-avoid-memory-ove.patch virtio_balloon-fix-endless-deflation-and-inflation-on-arm64.patch +treewide-spelling-fix-in-comment.patch +igb-fix-potential-memory-leak-in-igb_add_ethtool_nfc.patch +r8152-increase-usb-control-msg-timeout-to-5000ms-as-.patch +tcp-fix-wrong-rto-timeout-when-received-sack-renegin.patch +gtp-uapi-fix-gtpa_max.patch +i40e-fix-wrong-check-for-i40e_txr_flags_wb_on_itr.patch diff --git a/queue-4.14/tcp-fix-wrong-rto-timeout-when-received-sack-renegin.patch b/queue-4.14/tcp-fix-wrong-rto-timeout-when-received-sack-renegin.patch new file mode 100644 index 00000000000..7c74e567fd4 --- /dev/null +++ b/queue-4.14/tcp-fix-wrong-rto-timeout-when-received-sack-renegin.patch @@ -0,0 +1,96 @@ +From 60fdddb6c17090eaad79861c9c542322f437a33e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 21 Oct 2023 08:19:47 +0800 +Subject: tcp: fix wrong RTO timeout when received SACK reneging + +From: Fred Chen + +[ Upstream commit d2a0fc372aca561556e765d0a9ec365c7c12f0ad ] + +This commit fix wrong RTO timeout when received SACK reneging. + +When an ACK arrived pointing to a SACK reneging, tcp_check_sack_reneging() +will rearm the RTO timer for min(1/2*srtt, 10ms) into to the future. + +But since the commit 62d9f1a6945b ("tcp: fix TLP timer not set when +CA_STATE changes from DISORDER to OPEN") merged, the tcp_set_xmit_timer() +is moved after tcp_fastretrans_alert()(which do the SACK reneging check), +so the RTO timeout will be overwrited by tcp_set_xmit_timer() with +icsk_rto instead of 1/2*srtt. + +Here is a packetdrill script to check this bug: +0 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3 ++0 bind(3, ..., ...) = 0 ++0 listen(3, 1) = 0 + +// simulate srtt to 100ms ++0 < S 0:0(0) win 32792 ++0 > S. 0:0(0) ack 1 ++.1 < . 1:1(0) ack 1 win 1024 + ++0 accept(3, ..., ...) = 4 + ++0 write(4, ..., 10000) = 10000 ++0 > P. 1:10001(10000) ack 1 + +// inject sack ++.1 < . 1:1(0) ack 1 win 257 ++0 > . 1:1001(1000) ack 1 + +// inject sack reneging ++.1 < . 1:1(0) ack 1001 win 257 + +// we expect rto fired in 1/2*srtt (50ms) ++.05 > . 1001:2001(1000) ack 1 + +This fix remove the FLAG_SET_XMIT_TIMER from ack_flag when +tcp_check_sack_reneging() set RTO timer with 1/2*srtt to avoid +being overwrited later. + +Fixes: 62d9f1a6945b ("tcp: fix TLP timer not set when CA_STATE changes from DISORDER to OPEN") +Signed-off-by: Fred Chen +Reviewed-by: Neal Cardwell +Tested-by: Neal Cardwell +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_input.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index 491c16d8e9ddc..e65daf71a52d7 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -2069,16 +2069,17 @@ void tcp_enter_loss(struct sock *sk) + * restore sanity to the SACK scoreboard. If the apparent reneging + * persists until this RTO then we'll clear the SACK scoreboard. + */ +-static bool tcp_check_sack_reneging(struct sock *sk, int flag) ++static bool tcp_check_sack_reneging(struct sock *sk, int *ack_flag) + { +- if (flag & FLAG_SACK_RENEGING && +- flag & FLAG_SND_UNA_ADVANCED) { ++ if (*ack_flag & FLAG_SACK_RENEGING && ++ *ack_flag & FLAG_SND_UNA_ADVANCED) { + struct tcp_sock *tp = tcp_sk(sk); + unsigned long delay = max(usecs_to_jiffies(tp->srtt_us >> 4), + msecs_to_jiffies(10)); + + inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS, + delay, TCP_RTO_MAX); ++ *ack_flag &= ~FLAG_SET_XMIT_TIMER; + return true; + } + return false; +@@ -2870,7 +2871,7 @@ static void tcp_fastretrans_alert(struct sock *sk, const int acked, + tp->prior_ssthresh = 0; + + /* B. In all the states check for reneging SACKs. */ +- if (tcp_check_sack_reneging(sk, flag)) ++ if (tcp_check_sack_reneging(sk, ack_flag)) + return; + + /* C. Check consistency of the current state. */ +-- +2.42.0 + diff --git a/queue-4.14/treewide-spelling-fix-in-comment.patch b/queue-4.14/treewide-spelling-fix-in-comment.patch new file mode 100644 index 00000000000..79b3c17ccb9 --- /dev/null +++ b/queue-4.14/treewide-spelling-fix-in-comment.patch @@ -0,0 +1,36 @@ +From 1e9abf9c45e02117abc74154320d5f3399b7c87f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Oct 2023 17:31:56 +0800 +Subject: treewide: Spelling fix in comment + +From: Kunwu Chan + +[ Upstream commit fb71ba0ed8be9534493c80ba00142a64d9972a72 ] + +reques -> request + +Fixes: 09dde54c6a69 ("PS3: gelic: Add wireless support for PS3") +Signed-off-by: Kunwu Chan +Reviewed-by: Geert Uytterhoeven +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/toshiba/ps3_gelic_wireless.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/toshiba/ps3_gelic_wireless.c b/drivers/net/ethernet/toshiba/ps3_gelic_wireless.c +index eed18f88bdff7..e70175f40a824 100644 +--- a/drivers/net/ethernet/toshiba/ps3_gelic_wireless.c ++++ b/drivers/net/ethernet/toshiba/ps3_gelic_wireless.c +@@ -1232,7 +1232,7 @@ static int gelic_wl_set_encodeext(struct net_device *netdev, + key_index = wl->current_key; + + if (!enc->length && (ext->ext_flags & IW_ENCODE_EXT_SET_TX_KEY)) { +- /* reques to change default key index */ ++ /* request to change default key index */ + pr_debug("%s: request to change default key to %d\n", + __func__, key_index); + wl->current_key = key_index; +-- +2.42.0 +