From: Sasha Levin Date: Mon, 1 Feb 2021 16:51:37 +0000 (-0500) Subject: Fixes for 5.4 X-Git-Tag: v4.4.255~20 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=6ccf2100e5ce60f0c26985a992471fba8e1d8845;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.4 Signed-off-by: Sasha Levin --- diff --git a/queue-5.4/arm-dts-imx6qdl-kontron-samx6i-fix-i2c_lcd-cam-defau.patch b/queue-5.4/arm-dts-imx6qdl-kontron-samx6i-fix-i2c_lcd-cam-defau.patch new file mode 100644 index 00000000000..103c7f03a99 --- /dev/null +++ b/queue-5.4/arm-dts-imx6qdl-kontron-samx6i-fix-i2c_lcd-cam-defau.patch @@ -0,0 +1,44 @@ +From c091f637e51582519c40717720eeafae80263b04 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Jan 2021 10:24:07 +0100 +Subject: ARM: dts: imx6qdl-kontron-samx6i: fix i2c_lcd/cam default status + +From: Marco Felsch + +[ Upstream commit 70b6ff4c549a62b59b286445f66cfec6c5327ac8 ] + +Fix typo so the gpio i2c busses are really disabled. + +Fixes: 2125212785c9 ("ARM: dts: imx6qdl-kontron-samx6i: add Kontron SMARC SoM Support") +Signed-off-by: Marco Felsch +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi b/arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi +index 6acc8591219a7..eea317b41020d 100644 +--- a/arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi ++++ b/arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi +@@ -167,7 +167,7 @@ + i2c-gpio,delay-us = <2>; /* ~100 kHz */ + #address-cells = <1>; + #size-cells = <0>; +- status = "disabld"; ++ status = "disabled"; + }; + + i2c_cam: i2c-gpio-cam { +@@ -179,7 +179,7 @@ + i2c-gpio,delay-us = <2>; /* ~100 kHz */ + #address-cells = <1>; + #size-cells = <0>; +- status = "disabld"; ++ status = "disabled"; + }; + }; + +-- +2.27.0 + diff --git a/queue-5.4/arm64-dts-ls1028a-fix-the-offset-of-the-reset-regist.patch b/queue-5.4/arm64-dts-ls1028a-fix-the-offset-of-the-reset-regist.patch new file mode 100644 index 00000000000..84432d44cf2 --- /dev/null +++ b/queue-5.4/arm64-dts-ls1028a-fix-the-offset-of-the-reset-regist.patch @@ -0,0 +1,40 @@ +From 005137d402c351852ca7bc6be53d032f1bc14c7f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Dec 2020 22:26:22 +0100 +Subject: arm64: dts: ls1028a: fix the offset of the reset register + +From: Michael Walle + +[ Upstream commit 1653e3d470629d25c64cd8a2f84adb20a9348b0c ] + +The offset of the reset request register is 0, the absolute address is +0x1e60000. Boards without PSCI support will fail to perform a reset: + +[ 26.734700] reboot: Restarting system +[ 27.743259] Unable to restart system +[ 27.746845] Reboot failed -- System halted + +Fixes: 8897f3255c9c ("arm64: dts: Add support for NXP LS1028A SoC") +Signed-off-by: Michael Walle +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi +index 795d6ca4bbd1f..bd99fa68b7630 100644 +--- a/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi ++++ b/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi +@@ -103,7 +103,7 @@ + reboot { + compatible ="syscon-reboot"; + regmap = <&rst>; +- offset = <0xb0>; ++ offset = <0>; + mask = <0x02>; + }; + +-- +2.27.0 + diff --git a/queue-5.4/asoc-intel-skylake-skl-topology-fix-oops-ib-skl_tplg.patch b/queue-5.4/asoc-intel-skylake-skl-topology-fix-oops-ib-skl_tplg.patch new file mode 100644 index 00000000000..8602001939b --- /dev/null +++ b/queue-5.4/asoc-intel-skylake-skl-topology-fix-oops-ib-skl_tplg.patch @@ -0,0 +1,66 @@ +From 6974319f36026f8e82fe5879e2eaa4e68dae40d3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Jan 2021 18:16:43 +0100 +Subject: ASoC: Intel: Skylake: skl-topology: Fix OOPs ib skl_tplg_complete + +From: Ricardo Ribalda + +[ Upstream commit c1c3ba1f78354a20222d291ed6fedd17b7a74fd7 ] + +If dobj->control is not initialized we end up in an OOPs during +skl_tplg_complete: + +[ 26.553358] BUG: kernel NULL pointer dereference, address: +0000000000000078 +[ 26.561151] #PF: supervisor read access in kernel mode +[ 26.566897] #PF: error_code(0x0000) - not-present page +[ 26.572642] PGD 0 P4D 0 +[ 26.575479] Oops: 0000 [#1] PREEMPT SMP PTI +[ 26.580158] CPU: 2 PID: 2082 Comm: udevd Tainted: G C +5.4.81 #4 +[ 26.588232] Hardware name: HP Soraka/Soraka, BIOS +Google_Soraka.10431.106.0 12/03/2019 +[ 26.597082] RIP: 0010:skl_tplg_complete+0x70/0x144 [snd_soc_skl] + +Fixes: 2d744ecf2b98 ("ASoC: Intel: Skylake: Automatic DMIC format configuration according to information from NHL") +Signed-off-by: Ricardo Ribalda +Reviewed-by: Cezary Rojewski +Tested-by: Lukasz Majczak +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20210121171644.131059-1-ribalda@chromium.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/skylake/skl-topology.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/sound/soc/intel/skylake/skl-topology.c b/sound/soc/intel/skylake/skl-topology.c +index aa5833001fde5..2cb719893324a 100644 +--- a/sound/soc/intel/skylake/skl-topology.c ++++ b/sound/soc/intel/skylake/skl-topology.c +@@ -3619,15 +3619,16 @@ static void skl_tplg_complete(struct snd_soc_component *component) + + list_for_each_entry(dobj, &component->dobj_list, list) { + struct snd_kcontrol *kcontrol = dobj->control.kcontrol; +- struct soc_enum *se = +- (struct soc_enum *)kcontrol->private_value; +- char **texts = dobj->control.dtexts; ++ struct soc_enum *se; ++ char **texts; + char chan_text[4]; + +- if (dobj->type != SND_SOC_DOBJ_ENUM || +- dobj->control.kcontrol->put != +- skl_tplg_multi_config_set_dmic) ++ if (dobj->type != SND_SOC_DOBJ_ENUM || !kcontrol || ++ kcontrol->put != skl_tplg_multi_config_set_dmic) + continue; ++ ++ se = (struct soc_enum *)kcontrol->private_value; ++ texts = dobj->control.dtexts; + sprintf(chan_text, "c%d", mach->mach_params.dmic_num); + + for (i = 0; i < se->items; i++) { +-- +2.27.0 + diff --git a/queue-5.4/can-dev-prevent-potential-information-leak-in-can_fi.patch b/queue-5.4/can-dev-prevent-potential-information-leak-in-can_fi.patch new file mode 100644 index 00000000000..9de09c64302 --- /dev/null +++ b/queue-5.4/can-dev-prevent-potential-information-leak-in-can_fi.patch @@ -0,0 +1,38 @@ +From 71ecf864fd628ddf029f2bf60368c55d58157b01 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Jan 2021 09:08:05 +0300 +Subject: can: dev: prevent potential information leak in can_fill_info() + +From: Dan Carpenter + +[ Upstream commit b552766c872f5b0d90323b24e4c9e8fa67486dd5 ] + +The "bec" struct isn't necessarily always initialized. For example, the +mcp251xfd_get_berr_counter() function doesn't initialize anything if the +interface is down. + +Fixes: 52c793f24054 ("can: netlink support for bus-error reporting and counters") +Link: https://lore.kernel.org/r/YAkaRdRJncsJO8Ve@mwanda +Signed-off-by: Dan Carpenter +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/dev.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c +index 247aeacb3a440..2ae9feb99a07d 100644 +--- a/drivers/net/can/dev.c ++++ b/drivers/net/can/dev.c +@@ -1134,7 +1134,7 @@ static int can_fill_info(struct sk_buff *skb, const struct net_device *dev) + { + struct can_priv *priv = netdev_priv(dev); + struct can_ctrlmode cm = {.flags = priv->ctrlmode}; +- struct can_berr_counter bec; ++ struct can_berr_counter bec = { }; + enum can_state state = priv->state; + + if (priv->do_get_state) +-- +2.27.0 + diff --git a/queue-5.4/firmware-imx-select-soc_bus-to-fix-firmware-build.patch b/queue-5.4/firmware-imx-select-soc_bus-to-fix-firmware-build.patch new file mode 100644 index 00000000000..bf9bfb565f8 --- /dev/null +++ b/queue-5.4/firmware-imx-select-soc_bus-to-fix-firmware-build.patch @@ -0,0 +1,44 @@ +From 9168467d3ea9d3f0caae9b6972d16ee5c86db010 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Jan 2021 19:32:59 -0800 +Subject: firmware: imx: select SOC_BUS to fix firmware build + +From: Randy Dunlap + +[ Upstream commit 82c082784e03a9a9c043345f9bc04bc8254cf6da ] + +Fix build error in firmware/imx/ selecting SOC_BUS. + +riscv32-linux-ld: drivers/firmware/imx/imx-scu-soc.o: in function `.L9': +imx-scu-soc.c:(.text+0x1b0): undefined reference to `soc_device_register' + +Fixes: edbee095fafb ("firmware: imx: add SCU firmware driver support") +Signed-off-by: Randy Dunlap +Reported-by: kernel test robot +Cc: Atish Patra +Cc: Palmer Dabbelt +Cc: Ard Biesheuvel +Cc: Anson Huang +Cc: Daniel Baluta +Reviewed-by: Dong Aisheng +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + drivers/firmware/imx/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/firmware/imx/Kconfig b/drivers/firmware/imx/Kconfig +index 0dbee32da4c6d..5d995fe64b5ca 100644 +--- a/drivers/firmware/imx/Kconfig ++++ b/drivers/firmware/imx/Kconfig +@@ -13,6 +13,7 @@ config IMX_DSP + config IMX_SCU + bool "IMX SCU Protocol driver" + depends on IMX_MBOX ++ select SOC_BUS + help + The System Controller Firmware (SCFW) is a low-level system function + which runs on a dedicated Cortex-M core to provide power, clock, and +-- +2.27.0 + diff --git a/queue-5.4/i40e-acquire-vsi-pointer-only-after-vf-is-initialize.patch b/queue-5.4/i40e-acquire-vsi-pointer-only-after-vf-is-initialize.patch new file mode 100644 index 00000000000..7b780736df4 --- /dev/null +++ b/queue-5.4/i40e-acquire-vsi-pointer-only-after-vf-is-initialize.patch @@ -0,0 +1,64 @@ +From aca9b5f6eafa63b9392a7c7cd05939f630dd48ee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Nov 2020 14:12:57 +0100 +Subject: i40e: acquire VSI pointer only after VF is initialized + +From: Stefan Assmann + +[ Upstream commit 67a3c6b3cc40bb217c3ff947a55053151a00fea0 ] + +This change simplifies the VF initialization check and also minimizes +the delay between acquiring the VSI pointer and using it. As known by +the commit being fixed, there is a risk of the VSI pointer getting +changed. Therefore minimize the delay between getting and using the +pointer. + +Fixes: 9889707b06ac ("i40e: Fix crash caused by stress setting of VF MAC addresses") +Signed-off-by: Stefan Assmann +Reviewed-by: Jacob Keller +Tested-by: Konrad Jankowski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 11 ++++------- + 1 file changed, 4 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +index c952212900fcf..c20dc689698ed 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +@@ -3980,20 +3980,16 @@ int i40e_ndo_set_vf_mac(struct net_device *netdev, int vf_id, u8 *mac) + goto error_param; + + vf = &pf->vf[vf_id]; +- vsi = pf->vsi[vf->lan_vsi_idx]; + + /* When the VF is resetting wait until it is done. + * It can take up to 200 milliseconds, + * but wait for up to 300 milliseconds to be safe. +- * If the VF is indeed in reset, the vsi pointer has +- * to show on the newly loaded vsi under pf->vsi[id]. ++ * Acquire the VSI pointer only after the VF has been ++ * properly initialized. + */ + for (i = 0; i < 15; i++) { +- if (test_bit(I40E_VF_STATE_INIT, &vf->vf_states)) { +- if (i > 0) +- vsi = pf->vsi[vf->lan_vsi_idx]; ++ if (test_bit(I40E_VF_STATE_INIT, &vf->vf_states)) + break; +- } + msleep(20); + } + if (!test_bit(I40E_VF_STATE_INIT, &vf->vf_states)) { +@@ -4002,6 +3998,7 @@ int i40e_ndo_set_vf_mac(struct net_device *netdev, int vf_id, u8 *mac) + ret = -EAGAIN; + goto error_param; + } ++ vsi = pf->vsi[vf->lan_vsi_idx]; + + if (is_multicast_ether_addr(mac)) { + dev_err(&pf->pdev->dev, +-- +2.27.0 + diff --git a/queue-5.4/igc-fix-link-speed-advertising.patch b/queue-5.4/igc-fix-link-speed-advertising.patch new file mode 100644 index 00000000000..22cb6b8ebbd --- /dev/null +++ b/queue-5.4/igc-fix-link-speed-advertising.patch @@ -0,0 +1,81 @@ +From a5b9dc018781e8c6e36d6f5e8ba1ce05c9b567f7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Nov 2020 20:50:40 +0100 +Subject: igc: fix link speed advertising + +From: Corinna Vinschen + +[ Upstream commit 329a3678ec69962aa67c91397efbd46d36635f91 ] + +Link speed advertising in igc has two problems: + +- When setting the advertisement via ethtool, the link speed is converted + to the legacy 32 bit representation for the intel PHY code. + This inadvertently drops ETHTOOL_LINK_MODE_2500baseT_Full_BIT (being + beyond bit 31). As a result, any call to `ethtool -s ...' drops the + 2500Mbit/s link speed from the PHY settings. Only reloading the driver + alleviates that problem. + + Fix this by converting the ETHTOOL_LINK_MODE_2500baseT_Full_BIT to the + Intel PHY ADVERTISE_2500_FULL bit explicitly. + +- Rather than checking the actual PHY setting, the .get_link_ksettings + function always fills link_modes.advertising with all link speeds + the device is capable of. + + Fix this by checking the PHY autoneg_advertised settings and report + only the actually advertised speeds up to ethtool. + +Fixes: 8c5ad0dae93c ("igc: Add ethtool support") +Signed-off-by: Corinna Vinschen +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/igc/igc_ethtool.c | 24 +++++++++++++++----- + 1 file changed, 18 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/ethernet/intel/igc/igc_ethtool.c b/drivers/net/ethernet/intel/igc/igc_ethtool.c +index ac98f1d968921..0303eeb760505 100644 +--- a/drivers/net/ethernet/intel/igc/igc_ethtool.c ++++ b/drivers/net/ethernet/intel/igc/igc_ethtool.c +@@ -1670,12 +1670,18 @@ static int igc_get_link_ksettings(struct net_device *netdev, + cmd->base.phy_address = hw->phy.addr; + + /* advertising link modes */ +- ethtool_link_ksettings_add_link_mode(cmd, advertising, 10baseT_Half); +- ethtool_link_ksettings_add_link_mode(cmd, advertising, 10baseT_Full); +- ethtool_link_ksettings_add_link_mode(cmd, advertising, 100baseT_Half); +- ethtool_link_ksettings_add_link_mode(cmd, advertising, 100baseT_Full); +- ethtool_link_ksettings_add_link_mode(cmd, advertising, 1000baseT_Full); +- ethtool_link_ksettings_add_link_mode(cmd, advertising, 2500baseT_Full); ++ if (hw->phy.autoneg_advertised & ADVERTISE_10_HALF) ++ ethtool_link_ksettings_add_link_mode(cmd, advertising, 10baseT_Half); ++ if (hw->phy.autoneg_advertised & ADVERTISE_10_FULL) ++ ethtool_link_ksettings_add_link_mode(cmd, advertising, 10baseT_Full); ++ if (hw->phy.autoneg_advertised & ADVERTISE_100_HALF) ++ ethtool_link_ksettings_add_link_mode(cmd, advertising, 100baseT_Half); ++ if (hw->phy.autoneg_advertised & ADVERTISE_100_FULL) ++ ethtool_link_ksettings_add_link_mode(cmd, advertising, 100baseT_Full); ++ if (hw->phy.autoneg_advertised & ADVERTISE_1000_FULL) ++ ethtool_link_ksettings_add_link_mode(cmd, advertising, 1000baseT_Full); ++ if (hw->phy.autoneg_advertised & ADVERTISE_2500_FULL) ++ ethtool_link_ksettings_add_link_mode(cmd, advertising, 2500baseT_Full); + + /* set autoneg settings */ + if (hw->mac.autoneg == 1) { +@@ -1786,6 +1792,12 @@ static int igc_set_link_ksettings(struct net_device *netdev, + + ethtool_convert_link_mode_to_legacy_u32(&advertising, + cmd->link_modes.advertising); ++ /* Converting to legacy u32 drops ETHTOOL_LINK_MODE_2500baseT_Full_BIT. ++ * We have to check this and convert it to ADVERTISE_2500_FULL ++ * (aka ETHTOOL_LINK_MODE_2500baseX_Full_BIT) explicitly. ++ */ ++ if (ethtool_link_ksettings_test_link_mode(cmd, advertising, 2500baseT_Full)) ++ advertising |= ADVERTISE_2500_FULL; + + if (cmd->base.autoneg == AUTONEG_ENABLE) { + hw->mac.autoneg = 1; +-- +2.27.0 + diff --git a/queue-5.4/iwlwifi-pcie-reschedule-in-long-running-memory-reads.patch b/queue-5.4/iwlwifi-pcie-reschedule-in-long-running-memory-reads.patch new file mode 100644 index 00000000000..159ecb1c5a0 --- /dev/null +++ b/queue-5.4/iwlwifi-pcie-reschedule-in-long-running-memory-reads.patch @@ -0,0 +1,70 @@ +From 0e1d40c51d10eae4a3c7d25ffef7e204adae8eae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Jan 2021 13:05:58 +0200 +Subject: iwlwifi: pcie: reschedule in long-running memory reads + +From: Johannes Berg + +[ Upstream commit 3d372c4edfd4dffb7dea71c6b096fb414782b776 ] + +If we spin for a long time in memory reads that (for some reason in +hardware) take a long time, then we'll eventually get messages such +as + + watchdog: BUG: soft lockup - CPU#2 stuck for 24s! [kworker/2:2:272] + +This is because the reading really does take a very long time, and +we don't schedule, so we're hogging the CPU with this task, at least +if CONFIG_PREEMPT is not set, e.g. with CONFIG_PREEMPT_VOLUNTARY=y. + +Previously I misinterpreted the situation and thought that this was +only going to happen if we had interrupts disabled, and then fixed +this (which is good anyway, however), but that didn't always help; +looking at it again now I realized that the spin unlock will only +reschedule if CONFIG_PREEMPT is used. + +In order to avoid this issue, change the code to cond_resched() if +we've been spinning for too long here. + +Signed-off-by: Johannes Berg +Fixes: 04516706bb99 ("iwlwifi: pcie: limit memory read spin time") +Signed-off-by: Luca Coelho +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/iwlwifi.20210115130253.217a9d6a6a12.If964cb582ab0aaa94e81c4ff3b279eaafda0fd3f@changeid +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/pcie/trans.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c +index d2ed9e0239cb9..0581f082301e0 100644 +--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c ++++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c +@@ -2184,6 +2184,7 @@ static int iwl_trans_pcie_read_mem(struct iwl_trans *trans, u32 addr, + while (offs < dwords) { + /* limit the time we spin here under lock to 1/2s */ + unsigned long end = jiffies + HZ / 2; ++ bool resched = false; + + if (iwl_trans_grab_nic_access(trans, &flags)) { + iwl_write32(trans, HBUS_TARG_MEM_RADDR, +@@ -2194,10 +2195,15 @@ static int iwl_trans_pcie_read_mem(struct iwl_trans *trans, u32 addr, + HBUS_TARG_MEM_RDAT); + offs++; + +- if (time_after(jiffies, end)) ++ if (time_after(jiffies, end)) { ++ resched = true; + break; ++ } + } + iwl_trans_release_nic_access(trans, &flags); ++ ++ if (resched) ++ cond_resched(); + } else { + return -EBUSY; + } +-- +2.27.0 + diff --git a/queue-5.4/iwlwifi-pcie-use-jiffies-for-memory-read-spin-time-l.patch b/queue-5.4/iwlwifi-pcie-use-jiffies-for-memory-read-spin-time-l.patch new file mode 100644 index 00000000000..e1ca5a16440 --- /dev/null +++ b/queue-5.4/iwlwifi-pcie-use-jiffies-for-memory-read-spin-time-l.patch @@ -0,0 +1,56 @@ +From c75c70f3ceb18ec4d5251d0a6176b5e545b84791 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Jan 2021 13:05:57 +0200 +Subject: iwlwifi: pcie: use jiffies for memory read spin time limit + +From: Johannes Berg + +[ Upstream commit 6701317476bbfb1f341aa935ddf75eb73af784f9 ] + +There's no reason to use ktime_get() since we don't need any better +precision than jiffies, and since we no longer disable interrupts +around this code (when grabbing NIC access), jiffies will work fine. +Use jiffies instead of ktime_get(). + +This cleanup is preparation for the following patch "iwlwifi: pcie: reschedule +in long-running memory reads". The code gets simpler with the weird clock use +etc. removed before we add cond_resched(). + +Signed-off-by: Johannes Berg +Signed-off-by: Luca Coelho +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/iwlwifi.20210115130253.621c948b1fad.I3ee9f4bc4e74a0c9125d42fb7c35cd80df4698a1@changeid +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/pcie/trans.c | 8 ++------ + 1 file changed, 2 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c +index ef5a8ecabc60a..d2ed9e0239cb9 100644 +--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c ++++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c +@@ -2183,7 +2183,7 @@ static int iwl_trans_pcie_read_mem(struct iwl_trans *trans, u32 addr, + + while (offs < dwords) { + /* limit the time we spin here under lock to 1/2s */ +- ktime_t timeout = ktime_add_us(ktime_get(), 500 * USEC_PER_MSEC); ++ unsigned long end = jiffies + HZ / 2; + + if (iwl_trans_grab_nic_access(trans, &flags)) { + iwl_write32(trans, HBUS_TARG_MEM_RADDR, +@@ -2194,11 +2194,7 @@ static int iwl_trans_pcie_read_mem(struct iwl_trans *trans, u32 addr, + HBUS_TARG_MEM_RDAT); + offs++; + +- /* calling ktime_get is expensive so +- * do it once in 128 reads +- */ +- if (offs % 128 == 0 && ktime_after(ktime_get(), +- timeout)) ++ if (time_after(jiffies, end)) + break; + } + iwl_trans_release_nic_access(trans, &flags); +-- +2.27.0 + diff --git a/queue-5.4/mac80211-pause-tx-while-changing-interface-type.patch b/queue-5.4/mac80211-pause-tx-while-changing-interface-type.patch new file mode 100644 index 00000000000..d78cdcd3c0d --- /dev/null +++ b/queue-5.4/mac80211-pause-tx-while-changing-interface-type.patch @@ -0,0 +1,66 @@ +From a40744dd287d9fb12c09595a5a5123bb49bcf90c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Jan 2021 17:11:16 +0100 +Subject: mac80211: pause TX while changing interface type + +From: Johannes Berg + +[ Upstream commit 054c9939b4800a91475d8d89905827bf9e1ad97a ] + +syzbot reported a crash that happened when changing the interface +type around a lot, and while it might have been easy to fix just +the symptom there, a little deeper investigation found that really +the reason is that we allowed packets to be transmitted while in +the middle of changing the interface type. + +Disallow TX by stopping the queues while changing the type. + +Fixes: 34d4bc4d41d2 ("mac80211: support runtime interface type changes") +Reported-by: syzbot+d7a3b15976bf7de2238a@syzkaller.appspotmail.com +Link: https://lore.kernel.org/r/20210122171115.b321f98f4d4f.I6997841933c17b093535c31d29355be3c0c39628@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/ieee80211_i.h | 1 + + net/mac80211/iface.c | 6 ++++++ + 2 files changed, 7 insertions(+) + +diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h +index 05406e9c05b32..268f1d8f440ba 100644 +--- a/net/mac80211/ieee80211_i.h ++++ b/net/mac80211/ieee80211_i.h +@@ -1061,6 +1061,7 @@ enum queue_stop_reason { + IEEE80211_QUEUE_STOP_REASON_FLUSH, + IEEE80211_QUEUE_STOP_REASON_TDLS_TEARDOWN, + IEEE80211_QUEUE_STOP_REASON_RESERVE_TID, ++ IEEE80211_QUEUE_STOP_REASON_IFTYPE_CHANGE, + + IEEE80211_QUEUE_STOP_REASONS, + }; +diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c +index af8b09214786d..6089b09ec13b6 100644 +--- a/net/mac80211/iface.c ++++ b/net/mac80211/iface.c +@@ -1537,6 +1537,10 @@ static int ieee80211_runtime_change_iftype(struct ieee80211_sub_if_data *sdata, + if (ret) + return ret; + ++ ieee80211_stop_vif_queues(local, sdata, ++ IEEE80211_QUEUE_STOP_REASON_IFTYPE_CHANGE); ++ synchronize_net(); ++ + ieee80211_do_stop(sdata, false); + + ieee80211_teardown_sdata(sdata); +@@ -1557,6 +1561,8 @@ static int ieee80211_runtime_change_iftype(struct ieee80211_sub_if_data *sdata, + err = ieee80211_do_open(&sdata->wdev, false); + WARN(err, "type change: do_open returned %d", err); + ++ ieee80211_wake_vif_queues(local, sdata, ++ IEEE80211_QUEUE_STOP_REASON_IFTYPE_CHANGE); + return ret; + } + +-- +2.27.0 + diff --git a/queue-5.4/net-mlx5-fix-memory-leak-on-flow-table-creation-erro.patch b/queue-5.4/net-mlx5-fix-memory-leak-on-flow-table-creation-erro.patch new file mode 100644 index 00000000000..9d941392fb5 --- /dev/null +++ b/queue-5.4/net-mlx5-fix-memory-leak-on-flow-table-creation-erro.patch @@ -0,0 +1,36 @@ +From 53f994a458ad1b6886423650ddf969af944b82d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Jan 2021 14:04:29 +0200 +Subject: net/mlx5: Fix memory leak on flow table creation error flow + +From: Roi Dayan + +[ Upstream commit 487c6ef81eb98d0a43cb08be91b1fcc9b4250626 ] + +When we create the ft object we also init rhltable in ft->fgs_hash. +So in error flow before kfree of ft we need to destroy that rhltable. + +Fixes: 693c6883bbc4 ("net/mlx5: Add hash table for flow groups in flow table") +Signed-off-by: Roi Dayan +Reviewed-by: Maor Dickman +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c +index 2eceb72f0f647..4944c40436f08 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c +@@ -1068,6 +1068,7 @@ static struct mlx5_flow_table *__mlx5_create_flow_table(struct mlx5_flow_namespa + destroy_ft: + root->cmds->destroy_flow_table(root, ft); + free_ft: ++ rhltable_destroy(&ft->fgs_hash); + kfree(ft); + unlock_root: + mutex_unlock(&root->chain_lock); +-- +2.27.0 + diff --git a/queue-5.4/net-mlx5e-e-switch-fix-rate-calculation-for-overflow.patch b/queue-5.4/net-mlx5e-e-switch-fix-rate-calculation-for-overflow.patch new file mode 100644 index 00000000000..9e02b5de618 --- /dev/null +++ b/queue-5.4/net-mlx5e-e-switch-fix-rate-calculation-for-overflow.patch @@ -0,0 +1,69 @@ +From 9318cfc6dd3b98882c478f7399752bd6044b6980 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Jan 2021 16:13:22 +0200 +Subject: net/mlx5e: E-switch, Fix rate calculation for overflow + +From: Parav Pandit + +[ Upstream commit 1fe3e3166b35240615ab7f8276af2bbf2e51f559 ] + +rate_bytes_ps is a 64-bit field. It passed as 32-bit field to +apply_police_params(). Due to this when police rate is higher +than 4Gbps, 32-bit calculation ignores the carry. This results +in incorrect rate configurationn the device. + +Fix it by performing 64-bit calculation. + +Fixes: fcb64c0f5640 ("net/mlx5: E-Switch, add ingress rate support") +Signed-off-by: Parav Pandit +Reviewed-by: Eli Cohen +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +index ec117e4414250..37051a4820a08 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +@@ -57,6 +57,7 @@ + #include "lib/devcom.h" + #include "lib/geneve.h" + #include "diag/en_tc_tracepoint.h" ++#include + + struct mlx5_nic_flow_attr { + u32 action; +@@ -3943,13 +3944,13 @@ errout: + return err; + } + +-static int apply_police_params(struct mlx5e_priv *priv, u32 rate, ++static int apply_police_params(struct mlx5e_priv *priv, u64 rate, + struct netlink_ext_ack *extack) + { + struct mlx5e_rep_priv *rpriv = priv->ppriv; + struct mlx5_eswitch *esw; ++ u32 rate_mbps = 0; + u16 vport_num; +- u32 rate_mbps; + int err; + + vport_num = rpriv->rep->vport; +@@ -3966,7 +3967,11 @@ static int apply_police_params(struct mlx5e_priv *priv, u32 rate, + * Moreover, if rate is non zero we choose to configure to a minimum of + * 1 mbit/sec. + */ +- rate_mbps = rate ? max_t(u32, (rate * 8 + 500000) / 1000000, 1) : 0; ++ if (rate) { ++ rate = (rate * BITS_PER_BYTE) + 500000; ++ rate_mbps = max_t(u32, do_div(rate, 1000000), 1); ++ } ++ + err = mlx5_esw_modify_vport_rate(esw, vport_num, rate_mbps); + if (err) + NL_SET_ERR_MSG_MOD(extack, "failed applying action to hardware"); +-- +2.27.0 + diff --git a/queue-5.4/net-mlx5e-reduce-tc-unsupported-key-print-level.patch b/queue-5.4/net-mlx5e-reduce-tc-unsupported-key-print-level.patch new file mode 100644 index 00000000000..99beee81f90 --- /dev/null +++ b/queue-5.4/net-mlx5e-reduce-tc-unsupported-key-print-level.patch @@ -0,0 +1,46 @@ +From 35b34ea725b68b320fdf165b82edb5274c7f8e63 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Jan 2021 17:21:38 +0200 +Subject: net/mlx5e: Reduce tc unsupported key print level + +From: Maor Dickman + +[ Upstream commit 48470a90a42a64dd2f70743a149894a292b356e0 ] + +"Unsupported key used:" appears in kernel log when flows with +unsupported key are used, arp fields for example. + +OpenVSwitch was changed to match on arp fields by default that +caused this warning to appear in kernel log for every arp rule, which +can be a lot. + +Fix by lowering print level from warning to debug. + +Fixes: e3a2b7ed018e ("net/mlx5e: Support offload cls_flower with drop action") +Signed-off-by: Maor Dickman +Reviewed-by: Roi Dayan +Reviewed-by: Saeed Mahameed +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +index 37051a4820a08..6495c26d95969 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +@@ -1838,8 +1838,8 @@ static int __parse_cls_flower(struct mlx5e_priv *priv, + BIT(FLOW_DISSECTOR_KEY_ENC_IP) | + BIT(FLOW_DISSECTOR_KEY_ENC_OPTS))) { + NL_SET_ERR_MSG_MOD(extack, "Unsupported key"); +- netdev_warn(priv->netdev, "Unsupported key used: 0x%x\n", +- dissector->used_keys); ++ netdev_dbg(priv->netdev, "Unsupported key used: 0x%x\n", ++ dissector->used_keys); + return -EOPNOTSUPP; + } + +-- +2.27.0 + diff --git a/queue-5.4/nvme-multipath-early-exit-if-no-path-is-available.patch b/queue-5.4/nvme-multipath-early-exit-if-no-path-is-available.patch new file mode 100644 index 00000000000..0fa79c77340 --- /dev/null +++ b/queue-5.4/nvme-multipath-early-exit-if-no-path-is-available.patch @@ -0,0 +1,37 @@ +From 53a75c4d4bf058961607fca7a73da2075e0f52ca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Jan 2021 11:30:33 +0100 +Subject: nvme-multipath: Early exit if no path is available + +From: Daniel Wagner + +[ Upstream commit d1bcf006a9d3d63c1bcb65a993cb13756954cd9c ] + +nvme_round_robin_path() should test if the return ns pointer is valid. +nvme_next_ns() will return a NULL pointer if there is no path left. + +Fixes: 75c10e732724 ("nvme-multipath: round-robin I/O policy") +Signed-off-by: Daniel Wagner +Reviewed-by: Hannes Reinecke +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/multipath.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c +index 3968f89f7855a..0ac0bd4c65c4c 100644 +--- a/drivers/nvme/host/multipath.c ++++ b/drivers/nvme/host/multipath.c +@@ -233,7 +233,7 @@ static struct nvme_ns *nvme_round_robin_path(struct nvme_ns_head *head, + } + + for (ns = nvme_next_ns(head, old); +- ns != old; ++ ns && ns != old; + ns = nvme_next_ns(head, ns)) { + if (nvme_path_is_disabled(ns)) + continue; +-- +2.27.0 + diff --git a/queue-5.4/pnfs-nfsv4-fix-a-layout-segment-leak-in-pnfs_layout_.patch b/queue-5.4/pnfs-nfsv4-fix-a-layout-segment-leak-in-pnfs_layout_.patch new file mode 100644 index 00000000000..738bb73348c --- /dev/null +++ b/queue-5.4/pnfs-nfsv4-fix-a-layout-segment-leak-in-pnfs_layout_.patch @@ -0,0 +1,35 @@ +From e2b00fb375c41732d2f7f2d85205dc3e32da4ff2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Jan 2021 16:34:37 -0500 +Subject: pNFS/NFSv4: Fix a layout segment leak in pnfs_layout_process() + +From: Trond Myklebust + +[ Upstream commit 814b84971388cd5fb182f2e914265b3827758455 ] + +If the server returns a new stateid that does not match the one in our +cache, then pnfs_layout_process() will leak the layout segments returned +by pnfs_mark_layout_stateid_invalid(). + +Fixes: 9888d837f3cf ("pNFS: Force a retry of LAYOUTGET if the stateid doesn't match our cache") +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/pnfs.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c +index 4232f956bdac0..ca1d98f274d12 100644 +--- a/fs/nfs/pnfs.c ++++ b/fs/nfs/pnfs.c +@@ -2388,6 +2388,7 @@ out_forget: + spin_unlock(&ino->i_lock); + lseg->pls_layout = lo; + NFS_SERVER(ino)->pnfs_curr_ld->free_lseg(lseg); ++ pnfs_free_lseg_list(&free_me); + return ERR_PTR(-EAGAIN); + } + +-- +2.27.0 + diff --git a/queue-5.4/rdma-cxgb4-fix-the-reported-max_recv_sge-value.patch b/queue-5.4/rdma-cxgb4-fix-the-reported-max_recv_sge-value.patch new file mode 100644 index 00000000000..e420a2920eb --- /dev/null +++ b/queue-5.4/rdma-cxgb4-fix-the-reported-max_recv_sge-value.patch @@ -0,0 +1,39 @@ +From b01ecc98b68371a0e3306aeaeee88f2417babef0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Jan 2021 21:14:23 +0200 +Subject: RDMA/cxgb4: Fix the reported max_recv_sge value + +From: Kamal Heib + +[ Upstream commit a372173bf314d374da4dd1155549d8ca7fc44709 ] + +The max_recv_sge value is wrongly reported when calling query_qp, This is +happening due to a typo when assigning the max_recv_sge value, the value +of sq_max_sges was assigned instead of rq_max_sges. + +Fixes: 3e5c02c9ef9a ("iw_cxgb4: Support query_qp() verb") +Link: https://lore.kernel.org/r/20210114191423.423529-1-kamalheib1@gmail.com +Signed-off-by: Kamal Heib +Reviewed-by: Potnuri Bharat Teja +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/cxgb4/qp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c +index 89ac2f9ae6dd8..e7472f0da59d2 100644 +--- a/drivers/infiniband/hw/cxgb4/qp.c ++++ b/drivers/infiniband/hw/cxgb4/qp.c +@@ -2471,7 +2471,7 @@ int c4iw_ib_query_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr, + init_attr->cap.max_send_wr = qhp->attr.sq_num_entries; + init_attr->cap.max_recv_wr = qhp->attr.rq_num_entries; + init_attr->cap.max_send_sge = qhp->attr.sq_max_sges; +- init_attr->cap.max_recv_sge = qhp->attr.sq_max_sges; ++ init_attr->cap.max_recv_sge = qhp->attr.rq_max_sges; + init_attr->cap.max_inline_data = T4_MAX_SEND_INLINE; + init_attr->sq_sig_type = qhp->sq_sig_all ? IB_SIGNAL_ALL_WR : 0; + return 0; +-- +2.27.0 + diff --git a/queue-5.4/selftests-forwarding-specify-interface-when-invoking.patch b/queue-5.4/selftests-forwarding-specify-interface-when-invoking.patch new file mode 100644 index 00000000000..c70569c859f --- /dev/null +++ b/queue-5.4/selftests-forwarding-specify-interface-when-invoking.patch @@ -0,0 +1,53 @@ +From 77c2ea1ceedcccd09513c2877a83164843911e78 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Jan 2021 16:48:19 +0200 +Subject: selftests: forwarding: Specify interface when invoking mausezahn + +From: Danielle Ratson + +[ Upstream commit 11df27f7fdf02cc2bb354358ad482e1fdd690589 ] + +Specify the interface through which packets should be transmitted so +that the test will pass regardless of the libnet version against which +mausezahn is linked. + +Fixes: cab14d1087d9 ("selftests: Add version of router_multipath.sh using nexthop objects") +Fixes: 3d578d879517 ("selftests: forwarding: Test IPv4 weighted nexthops") +Signed-off-by: Danielle Ratson +Signed-off-by: Ido Schimmel +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/net/forwarding/router_mpath_nh.sh | 2 +- + tools/testing/selftests/net/forwarding/router_multipath.sh | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/testing/selftests/net/forwarding/router_mpath_nh.sh b/tools/testing/selftests/net/forwarding/router_mpath_nh.sh +index cf3d26c233e8e..7fcc42bc076fa 100755 +--- a/tools/testing/selftests/net/forwarding/router_mpath_nh.sh ++++ b/tools/testing/selftests/net/forwarding/router_mpath_nh.sh +@@ -197,7 +197,7 @@ multipath4_test() + t0_rp12=$(link_stats_tx_packets_get $rp12) + t0_rp13=$(link_stats_tx_packets_get $rp13) + +- ip vrf exec vrf-h1 $MZ -q -p 64 -A 192.0.2.2 -B 198.51.100.2 \ ++ ip vrf exec vrf-h1 $MZ $h1 -q -p 64 -A 192.0.2.2 -B 198.51.100.2 \ + -d 1msec -t udp "sp=1024,dp=0-32768" + + t1_rp12=$(link_stats_tx_packets_get $rp12) +diff --git a/tools/testing/selftests/net/forwarding/router_multipath.sh b/tools/testing/selftests/net/forwarding/router_multipath.sh +index 79a2099279621..464821c587a5e 100755 +--- a/tools/testing/selftests/net/forwarding/router_multipath.sh ++++ b/tools/testing/selftests/net/forwarding/router_multipath.sh +@@ -178,7 +178,7 @@ multipath4_test() + t0_rp12=$(link_stats_tx_packets_get $rp12) + t0_rp13=$(link_stats_tx_packets_get $rp13) + +- ip vrf exec vrf-h1 $MZ -q -p 64 -A 192.0.2.2 -B 198.51.100.2 \ ++ ip vrf exec vrf-h1 $MZ $h1 -q -p 64 -A 192.0.2.2 -B 198.51.100.2 \ + -d 1msec -t udp "sp=1024,dp=0-32768" + + t1_rp12=$(link_stats_tx_packets_get $rp12) +-- +2.27.0 + diff --git a/queue-5.4/selftests-xfrm-fix-test-return-value-override-issue-.patch b/queue-5.4/selftests-xfrm-fix-test-return-value-override-issue-.patch new file mode 100644 index 00000000000..200822a2596 --- /dev/null +++ b/queue-5.4/selftests-xfrm-fix-test-return-value-override-issue-.patch @@ -0,0 +1,66 @@ +From 983a5155cdff4c1fcab1a4990c40f766ecf130a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Dec 2020 17:52:04 +0800 +Subject: selftests: xfrm: fix test return value override issue in + xfrm_policy.sh + +From: Po-Hsu Lin + +[ Upstream commit f6e9ceb7a7fc321a31a9dde93a99b7b4b016a3b3 ] + +When running this xfrm_policy.sh test script, even with some cases +marked as FAIL, the overall test result will still be PASS: + +$ sudo ./xfrm_policy.sh +PASS: policy before exception matches +FAIL: expected ping to .254 to fail (exceptions) +PASS: direct policy matches (exceptions) +PASS: policy matches (exceptions) +FAIL: expected ping to .254 to fail (exceptions and block policies) +PASS: direct policy matches (exceptions and block policies) +PASS: policy matches (exceptions and block policies) +FAIL: expected ping to .254 to fail (exceptions and block policies after hresh changes) +PASS: direct policy matches (exceptions and block policies after hresh changes) +PASS: policy matches (exceptions and block policies after hresh changes) +FAIL: expected ping to .254 to fail (exceptions and block policies after hthresh change in ns3) +PASS: direct policy matches (exceptions and block policies after hthresh change in ns3) +PASS: policy matches (exceptions and block policies after hthresh change in ns3) +FAIL: expected ping to .254 to fail (exceptions and block policies after htresh change to normal) +PASS: direct policy matches (exceptions and block policies after htresh change to normal) +PASS: policy matches (exceptions and block policies after htresh change to normal) +PASS: policies with repeated htresh change +$ echo $? +0 + +This is because the $lret in check_xfrm() is not a local variable. +Therefore when a test failed in check_exceptions(), the non-zero $lret +will later get reset to 0 when the next test calls check_xfrm(). + +With this fix, the final return value will be 1. Make it easier for +testers to spot this failure. + +Fixes: 39aa6928d462d0 ("xfrm: policy: fix netlink/pf_key policy lookups") +Signed-off-by: Po-Hsu Lin +Acked-by: Florian Westphal +Signed-off-by: Steffen Klassert +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/net/xfrm_policy.sh | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/net/xfrm_policy.sh b/tools/testing/selftests/net/xfrm_policy.sh +index 7a1bf94c5bd38..5922941e70c6c 100755 +--- a/tools/testing/selftests/net/xfrm_policy.sh ++++ b/tools/testing/selftests/net/xfrm_policy.sh +@@ -202,7 +202,7 @@ check_xfrm() { + # 1: iptables -m policy rule count != 0 + rval=$1 + ip=$2 +- lret=0 ++ local lret=0 + + ip netns exec ns1 ping -q -c 1 10.0.2.$ip > /dev/null + +-- +2.27.0 + diff --git a/queue-5.4/series b/queue-5.4/series index 283cee616ff..a29ea1c39f0 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -30,3 +30,24 @@ tee-optee-replace-might_sleep-with-cond_resched.patch xen-blkfront-allow-discard-nodes-to-be-optional.patch arm-imx-build-suspend-imx6.s-with-arm-instruction-set.patch netfilter-nft_dynset-add-timeout-extension-to-template.patch +xfrm-fix-oops-in-xfrm_replay_advance_bmp.patch +xfrm-fix-disable_xfrm-sysctl-when-used-on-xfrm-inter.patch +selftests-xfrm-fix-test-return-value-override-issue-.patch +xfrm-fix-wraparound-in-xfrm_policy_addr_delta.patch +arm64-dts-ls1028a-fix-the-offset-of-the-reset-regist.patch +arm-dts-imx6qdl-kontron-samx6i-fix-i2c_lcd-cam-defau.patch +firmware-imx-select-soc_bus-to-fix-firmware-build.patch +rdma-cxgb4-fix-the-reported-max_recv_sge-value.patch +asoc-intel-skylake-skl-topology-fix-oops-ib-skl_tplg.patch +pnfs-nfsv4-fix-a-layout-segment-leak-in-pnfs_layout_.patch +iwlwifi-pcie-use-jiffies-for-memory-read-spin-time-l.patch +iwlwifi-pcie-reschedule-in-long-running-memory-reads.patch +mac80211-pause-tx-while-changing-interface-type.patch +i40e-acquire-vsi-pointer-only-after-vf-is-initialize.patch +igc-fix-link-speed-advertising.patch +net-mlx5-fix-memory-leak-on-flow-table-creation-erro.patch +net-mlx5e-e-switch-fix-rate-calculation-for-overflow.patch +net-mlx5e-reduce-tc-unsupported-key-print-level.patch +can-dev-prevent-potential-information-leak-in-can_fi.patch +nvme-multipath-early-exit-if-no-path-is-available.patch +selftests-forwarding-specify-interface-when-invoking.patch diff --git a/queue-5.4/xfrm-fix-disable_xfrm-sysctl-when-used-on-xfrm-inter.patch b/queue-5.4/xfrm-fix-disable_xfrm-sysctl-when-used-on-xfrm-inter.patch new file mode 100644 index 00000000000..e6fb60d7b40 --- /dev/null +++ b/queue-5.4/xfrm-fix-disable_xfrm-sysctl-when-used-on-xfrm-inter.patch @@ -0,0 +1,53 @@ +From 7e1a5ba285dd65c11cc16932808698528af6c94c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Dec 2020 17:00:46 +0200 +Subject: xfrm: fix disable_xfrm sysctl when used on xfrm interfaces + +From: Eyal Birger + +[ Upstream commit 9f8550e4bd9d78a8436c2061ad2530215f875376 ] + +The disable_xfrm flag signals that xfrm should not be performed during +routing towards a device before reaching device xmit. + +For xfrm interfaces this is usually desired as they perform the outbound +policy lookup as part of their xmit using their if_id. + +Before this change enabling this flag on xfrm interfaces prevented them +from xmitting as xfrm_lookup_with_ifid() would not perform a policy lookup +in case the original dst had the DST_NOXFRM flag. + +This optimization is incorrect when the lookup is done by the xfrm +interface xmit logic. + +Fix by performing policy lookup when invoked by xfrmi as if_id != 0. + +Similarly it's unlikely for the 'no policy exists on net' check to yield +any performance benefits when invoked from xfrmi. + +Fixes: f203b76d7809 ("xfrm: Add virtual xfrm interfaces") +Signed-off-by: Eyal Birger +Signed-off-by: Steffen Klassert +Signed-off-by: Sasha Levin +--- + net/xfrm/xfrm_policy.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c +index 2917711ff8ab6..780e96f0708e2 100644 +--- a/net/xfrm/xfrm_policy.c ++++ b/net/xfrm/xfrm_policy.c +@@ -3065,8 +3065,8 @@ struct dst_entry *xfrm_lookup_with_ifid(struct net *net, + xflo.flags = flags; + + /* To accelerate a bit... */ +- if ((dst_orig->flags & DST_NOXFRM) || +- !net->xfrm.policy_count[XFRM_POLICY_OUT]) ++ if (!if_id && ((dst_orig->flags & DST_NOXFRM) || ++ !net->xfrm.policy_count[XFRM_POLICY_OUT])) + goto nopol; + + xdst = xfrm_bundle_lookup(net, fl, family, dir, &xflo, if_id); +-- +2.27.0 + diff --git a/queue-5.4/xfrm-fix-oops-in-xfrm_replay_advance_bmp.patch b/queue-5.4/xfrm-fix-oops-in-xfrm_replay_advance_bmp.patch new file mode 100644 index 00000000000..082168c9b4d --- /dev/null +++ b/queue-5.4/xfrm-fix-oops-in-xfrm_replay_advance_bmp.patch @@ -0,0 +1,92 @@ +From cbe4f93f07eb66eb98809afa8320149d4fdac991 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Dec 2020 15:38:32 +0200 +Subject: xfrm: Fix oops in xfrm_replay_advance_bmp + +From: Shmulik Ladkani + +[ Upstream commit 56ce7c25ae1525d83cf80a880cf506ead1914250 ] + +When setting xfrm replay_window to values higher than 32, a rare +page-fault occurs in xfrm_replay_advance_bmp: + + BUG: unable to handle page fault for address: ffff8af350ad7920 + #PF: supervisor write access in kernel mode + #PF: error_code(0x0002) - not-present page + PGD ad001067 P4D ad001067 PUD 0 + Oops: 0002 [#1] SMP PTI + CPU: 3 PID: 30 Comm: ksoftirqd/3 Kdump: loaded Not tainted 5.4.52-050452-generic #202007160732 + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014 + RIP: 0010:xfrm_replay_advance_bmp+0xbb/0x130 + RSP: 0018:ffffa1304013ba40 EFLAGS: 00010206 + RAX: 000000000000010d RBX: 0000000000000002 RCX: 00000000ffffff4b + RDX: 0000000000000018 RSI: 00000000004c234c RDI: 00000000ffb3dbff + RBP: ffffa1304013ba50 R08: ffff8af330ad7920 R09: 0000000007fffffa + R10: 0000000000000800 R11: 0000000000000010 R12: ffff8af29d6258c0 + R13: ffff8af28b95c700 R14: 0000000000000000 R15: ffff8af29d6258fc + FS: 0000000000000000(0000) GS:ffff8af339ac0000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: ffff8af350ad7920 CR3: 0000000015ee4000 CR4: 00000000001406e0 + Call Trace: + xfrm_input+0x4e5/0xa10 + xfrm4_rcv_encap+0xb5/0xe0 + xfrm4_udp_encap_rcv+0x140/0x1c0 + +Analysis revealed offending code is when accessing: + + replay_esn->bmp[nr] |= (1U << bitnr); + +with 'nr' being 0x07fffffa. + +This happened in an SMP system when reordering of packets was present; +A packet arrived with a "too old" sequence number (outside the window, +i.e 'diff > replay_window'), and therefore the following calculation: + + bitnr = replay_esn->replay_window - (diff - pos); + +yields a negative result, but since bitnr is u32 we get a large unsigned +quantity (in crash dump above: 0xffffff4b seen in ecx). + +This was supposed to be protected by xfrm_input()'s former call to: + + if (x->repl->check(x, skb, seq)) { + +However, the state's spinlock x->lock is *released* after '->check()' +is performed, and gets re-acquired before '->advance()' - which gives a +chance for a different core to update the xfrm state, e.g. by advancing +'replay_esn->seq' when it encounters more packets - leading to a +'diff > replay_window' situation when original core continues to +xfrm_replay_advance_bmp(). + +An attempt to fix this issue was suggested in commit bcf66bf54aab +("xfrm: Perform a replay check after return from async codepaths"), +by calling 'x->repl->recheck()' after lock is re-acquired, but fix +applied only to asyncronous crypto algorithms. + +Augment the fix, by *always* calling 'recheck()' - irrespective if we're +using async crypto. + +Fixes: 0ebea8ef3559 ("[IPSEC]: Move state lock into x->type->input") +Signed-off-by: Shmulik Ladkani +Signed-off-by: Steffen Klassert +Signed-off-by: Sasha Levin +--- + net/xfrm/xfrm_input.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c +index 7a84745477919..e120df0a6da13 100644 +--- a/net/xfrm/xfrm_input.c ++++ b/net/xfrm/xfrm_input.c +@@ -656,7 +656,7 @@ resume: + /* only the first xfrm gets the encap type */ + encap_type = 0; + +- if (async && x->repl->recheck(x, skb, seq)) { ++ if (x->repl->recheck(x, skb, seq)) { + XFRM_INC_STATS(net, LINUX_MIB_XFRMINSTATESEQERROR); + goto drop_unlock; + } +-- +2.27.0 + diff --git a/queue-5.4/xfrm-fix-wraparound-in-xfrm_policy_addr_delta.patch b/queue-5.4/xfrm-fix-wraparound-in-xfrm_policy_addr_delta.patch new file mode 100644 index 00000000000..213dbce96ee --- /dev/null +++ b/queue-5.4/xfrm-fix-wraparound-in-xfrm_policy_addr_delta.patch @@ -0,0 +1,139 @@ +From f2036917b912210e69347a51ce2c70718805367c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Dec 2020 16:15:53 +0000 +Subject: xfrm: Fix wraparound in xfrm_policy_addr_delta() + +From: Visa Hankala + +[ Upstream commit da64ae2d35d3673233f0403b035d4c6acbf71965 ] + +Use three-way comparison for address components to avoid integer +wraparound in the result of xfrm_policy_addr_delta(). This ensures +that the search trees are built and traversed correctly. + +Treat IPv4 and IPv6 similarly by returning 0 when prefixlen == 0. +Prefix /0 has only one equivalence class. + +Fixes: 9cf545ebd591d ("xfrm: policy: store inexact policies in a tree ordered by destination address") +Signed-off-by: Visa Hankala +Acked-by: Florian Westphal +Signed-off-by: Steffen Klassert +Signed-off-by: Sasha Levin +--- + net/xfrm/xfrm_policy.c | 26 +++++++++---- + tools/testing/selftests/net/xfrm_policy.sh | 43 ++++++++++++++++++++++ + 2 files changed, 61 insertions(+), 8 deletions(-) + +diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c +index 780e96f0708e2..32c8163427970 100644 +--- a/net/xfrm/xfrm_policy.c ++++ b/net/xfrm/xfrm_policy.c +@@ -790,15 +790,22 @@ static int xfrm_policy_addr_delta(const xfrm_address_t *a, + const xfrm_address_t *b, + u8 prefixlen, u16 family) + { ++ u32 ma, mb, mask; + unsigned int pdw, pbi; + int delta = 0; + + switch (family) { + case AF_INET: +- if (sizeof(long) == 4 && prefixlen == 0) +- return ntohl(a->a4) - ntohl(b->a4); +- return (ntohl(a->a4) & ((~0UL << (32 - prefixlen)))) - +- (ntohl(b->a4) & ((~0UL << (32 - prefixlen)))); ++ if (prefixlen == 0) ++ return 0; ++ mask = ~0U << (32 - prefixlen); ++ ma = ntohl(a->a4) & mask; ++ mb = ntohl(b->a4) & mask; ++ if (ma < mb) ++ delta = -1; ++ else if (ma > mb) ++ delta = 1; ++ break; + case AF_INET6: + pdw = prefixlen >> 5; + pbi = prefixlen & 0x1f; +@@ -809,10 +816,13 @@ static int xfrm_policy_addr_delta(const xfrm_address_t *a, + return delta; + } + if (pbi) { +- u32 mask = ~0u << (32 - pbi); +- +- delta = (ntohl(a->a6[pdw]) & mask) - +- (ntohl(b->a6[pdw]) & mask); ++ mask = ~0U << (32 - pbi); ++ ma = ntohl(a->a6[pdw]) & mask; ++ mb = ntohl(b->a6[pdw]) & mask; ++ if (ma < mb) ++ delta = -1; ++ else if (ma > mb) ++ delta = 1; + } + break; + default: +diff --git a/tools/testing/selftests/net/xfrm_policy.sh b/tools/testing/selftests/net/xfrm_policy.sh +index 5922941e70c6c..bdf450eaf60cf 100755 +--- a/tools/testing/selftests/net/xfrm_policy.sh ++++ b/tools/testing/selftests/net/xfrm_policy.sh +@@ -287,6 +287,47 @@ check_hthresh_repeat() + return 0 + } + ++# insert non-overlapping policies in a random order and check that ++# all of them can be fetched using the traffic selectors. ++check_random_order() ++{ ++ local ns=$1 ++ local log=$2 ++ ++ for i in $(seq 100); do ++ ip -net $ns xfrm policy flush ++ for j in $(seq 0 16 255 | sort -R); do ++ ip -net $ns xfrm policy add dst $j.0.0.0/24 dir out priority 10 action allow ++ done ++ for j in $(seq 0 16 255); do ++ if ! ip -net $ns xfrm policy get dst $j.0.0.0/24 dir out > /dev/null; then ++ echo "FAIL: $log" 1>&2 ++ return 1 ++ fi ++ done ++ done ++ ++ for i in $(seq 100); do ++ ip -net $ns xfrm policy flush ++ for j in $(seq 0 16 255 | sort -R); do ++ local addr=$(printf "e000:0000:%02x00::/56" $j) ++ ip -net $ns xfrm policy add dst $addr dir out priority 10 action allow ++ done ++ for j in $(seq 0 16 255); do ++ local addr=$(printf "e000:0000:%02x00::/56" $j) ++ if ! ip -net $ns xfrm policy get dst $addr dir out > /dev/null; then ++ echo "FAIL: $log" 1>&2 ++ return 1 ++ fi ++ done ++ done ++ ++ ip -net $ns xfrm policy flush ++ ++ echo "PASS: $log" ++ return 0 ++} ++ + #check for needed privileges + if [ "$(id -u)" -ne 0 ];then + echo "SKIP: Need root privileges" +@@ -438,6 +479,8 @@ check_exceptions "exceptions and block policies after htresh change to normal" + + check_hthresh_repeat "policies with repeated htresh change" + ++check_random_order ns3 "policies inserted in random order" ++ + for i in 1 2 3 4;do ip netns del ns$i;done + + exit $ret +-- +2.27.0 +