From: Sasha Levin Date: Sat, 28 Oct 2023 02:53:52 +0000 (-0400) Subject: Fixes for 5.4 X-Git-Tag: v6.1.61~64 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=7ad4ae1aa3cb54aa2f7319e9f796312ce4bdf37b;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.4 Signed-off-by: Sasha Levin --- diff --git a/queue-5.4/arm-omap-timer32k-fix-all-kernel-doc-warnings.patch b/queue-5.4/arm-omap-timer32k-fix-all-kernel-doc-warnings.patch new file mode 100644 index 00000000000..b002d5d4cd0 --- /dev/null +++ b/queue-5.4/arm-omap-timer32k-fix-all-kernel-doc-warnings.patch @@ -0,0 +1,84 @@ +From c77ba9e4eefd9aebee0a921784bac31581104cd2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Oct 2023 17:16:03 -0700 +Subject: ARM: OMAP: timer32K: fix all kernel-doc warnings + +From: Randy Dunlap + +[ Upstream commit 7eeca8ccd1066c68d6002dbbe26433f8c17c53eb ] + +Fix kernel-doc warnings reported by the kernel test robot: + +timer32k.c:186: warning: cannot understand function prototype: 'struct timespec64 persistent_ts; ' +timer32k.c:191: warning: Function parameter or member 'ts' not described in 'omap_read_persistent_clock64' +timer32k.c:216: warning: Function parameter or member 'vbase' not described in 'omap_init_clocksource_32k' +timer32k.c:216: warning: Excess function parameter 'pbase' description in 'omap_init_clocksource_32k' +timer32k.c:216: warning: Excess function parameter 'size' description in 'omap_init_clocksource_32k' +timer32k.c:216: warning: No description found for return value of 'omap_init_clocksource_32k' + +Fixes: a451570c008b ("ARM: OMAP: 32k counter: Provide y2038-safe omap_read_persistent_clock() replacement") +Fixes: 1fe97c8f6a1d ("ARM: OMAP: Make OMAP clocksource source selection using kernel param") +Signed-off-by: Randy Dunlap +Reported-by: kernel test robot +Closes: https://lore.kernel.org/all/202310070106.8QSyJOm3-lkp@intel.com/ +Cc: Arnd Bergmann +Cc: Vaibhav Hiremath +Cc: Felipe Balbi +Cc: Tony Lindgren +Cc: Xunlei Pang +Cc: John Stultz +Cc: Ingo Molnar +Cc: Aaro Koskinen +Cc: Janusz Krzysztofik +Cc: linux-omap@vger.kernel.org +Cc: linux-arm-kernel@lists.infradead.org +Message-ID: <20231007001603.24972-1-rdunlap@infradead.org> +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/mach-omap1/timer32k.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +diff --git a/arch/arm/mach-omap1/timer32k.c b/arch/arm/mach-omap1/timer32k.c +index 11958ccd894dc..747899083f238 100644 +--- a/arch/arm/mach-omap1/timer32k.c ++++ b/arch/arm/mach-omap1/timer32k.c +@@ -176,17 +176,18 @@ static u64 notrace omap_32k_read_sched_clock(void) + return sync32k_cnt_reg ? readl_relaxed(sync32k_cnt_reg) : 0; + } + ++static struct timespec64 persistent_ts; ++static cycles_t cycles; ++static unsigned int persistent_mult, persistent_shift; ++ + /** + * omap_read_persistent_clock64 - Return time from a persistent clock. ++ * @ts: &struct timespec64 for the returned time + * + * Reads the time from a source which isn't disabled during PM, the + * 32k sync timer. Convert the cycles elapsed since last read into + * nsecs and adds to a monotonically increasing timespec64. + */ +-static struct timespec64 persistent_ts; +-static cycles_t cycles; +-static unsigned int persistent_mult, persistent_shift; +- + static void omap_read_persistent_clock64(struct timespec64 *ts) + { + unsigned long long nsecs; +@@ -206,10 +207,9 @@ static void omap_read_persistent_clock64(struct timespec64 *ts) + /** + * omap_init_clocksource_32k - setup and register counter 32k as a + * kernel clocksource +- * @pbase: base addr of counter_32k module +- * @size: size of counter_32k to map ++ * @vbase: base addr of counter_32k module + * +- * Returns 0 upon success or negative error code upon failure. ++ * Returns: %0 upon success or negative error code upon failure. + * + */ + int __init omap_init_clocksource_32k(void __iomem *vbase) +-- +2.42.0 + diff --git a/queue-5.4/arm-omap1-move-32k-counter-from-plat-omap-to-mach-om.patch b/queue-5.4/arm-omap1-move-32k-counter-from-plat-omap-to-mach-om.patch new file mode 100644 index 00000000000..280e024f902 --- /dev/null +++ b/queue-5.4/arm-omap1-move-32k-counter-from-plat-omap-to-mach-om.patch @@ -0,0 +1,346 @@ +From 1f137417252d2bf3728978d1db09c7cbabf0dd73 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Sep 2019 13:57:31 +0200 +Subject: ARM: omap1: move 32k counter from plat-omap to mach-omap1 + +From: Arnd Bergmann + +[ Upstream commit d379e8899a8da1041c347ae5b792773c48a559a9 ] + +omap2 stopped using this code with commit 8d39ff3d1696 ("ARM: OMAP2+: +Remove unused legacy code for timer"), so just move it to mach-omap1 now, +along with the other half of that driver. + +Acked-by: Tony Lindgren +Signed-off-by: Arnd Bergmann +Stable-dep-of: 7eeca8ccd106 ("ARM: OMAP: timer32K: fix all kernel-doc warnings") +Signed-off-by: Sasha Levin +--- + arch/arm/mach-omap1/Kconfig | 16 +++ + arch/arm/mach-omap1/timer32k.c | 96 ++++++++++++++- + arch/arm/plat-omap/Kconfig | 17 --- + arch/arm/plat-omap/Makefile | 2 +- + arch/arm/plat-omap/counter_32k.c | 114 ------------------ + arch/arm/plat-omap/include/plat/counter-32k.h | 1 - + 6 files changed, 110 insertions(+), 136 deletions(-) + delete mode 100644 arch/arm/plat-omap/counter_32k.c + delete mode 100644 arch/arm/plat-omap/include/plat/counter-32k.h + +diff --git a/arch/arm/mach-omap1/Kconfig b/arch/arm/mach-omap1/Kconfig +index 2a17dc1d122c0..60f4362034540 100644 +--- a/arch/arm/mach-omap1/Kconfig ++++ b/arch/arm/mach-omap1/Kconfig +@@ -59,6 +59,22 @@ config OMAP_MUX_WARNINGS + to change the pin multiplexing setup. When there are no warnings + printed, it's safe to deselect OMAP_MUX for your product. + ++config OMAP_32K_TIMER ++ bool "Use 32KHz timer" ++ depends on ARCH_OMAP16XX ++ default ARCH_OMAP16XX ++ help ++ Select this option if you want to enable the OMAP 32KHz timer. ++ This timer saves power compared to the OMAP_MPU_TIMER, and has ++ support for no tick during idle. The 32KHz timer provides less ++ intra-tick resolution than OMAP_MPU_TIMER. The 32KHz timer is ++ currently only available for OMAP16XX, 24XX, 34XX, OMAP4/5 and DRA7XX. ++ ++ On OMAP2PLUS this value is only used for CONFIG_HZ and ++ CLOCK_TICK_RATE compile time calculation. ++ The actual timer selection is done in the board file ++ through the (DT_)MACHINE_START structure. ++ + comment "OMAP Board Type" + depends on ARCH_OMAP1 + +diff --git a/arch/arm/mach-omap1/timer32k.c b/arch/arm/mach-omap1/timer32k.c +index 780fdf03c3cee..11958ccd894dc 100644 +--- a/arch/arm/mach-omap1/timer32k.c ++++ b/arch/arm/mach-omap1/timer32k.c +@@ -45,15 +45,13 @@ + #include + #include + #include ++#include + + #include + #include + #include + +-#include +- + #include +- + #include "common.h" + + /* +@@ -159,6 +157,98 @@ static __init void omap_init_32k_timer(void) + OMAP_32K_TICKS_PER_SEC, 1, 0xfffffffe); + } + ++/* OMAP2_32KSYNCNT_CR_OFF: offset of 32ksync counter register */ ++#define OMAP2_32KSYNCNT_REV_OFF 0x0 ++#define OMAP2_32KSYNCNT_REV_SCHEME (0x3 << 30) ++#define OMAP2_32KSYNCNT_CR_OFF_LOW 0x10 ++#define OMAP2_32KSYNCNT_CR_OFF_HIGH 0x30 ++ ++/* ++ * 32KHz clocksource ... always available, on pretty most chips except ++ * OMAP 730 and 1510. Other timers could be used as clocksources, with ++ * higher resolution in free-running counter modes (e.g. 12 MHz xtal), ++ * but systems won't necessarily want to spend resources that way. ++ */ ++static void __iomem *sync32k_cnt_reg; ++ ++static u64 notrace omap_32k_read_sched_clock(void) ++{ ++ return sync32k_cnt_reg ? readl_relaxed(sync32k_cnt_reg) : 0; ++} ++ ++/** ++ * omap_read_persistent_clock64 - Return time from a persistent clock. ++ * ++ * Reads the time from a source which isn't disabled during PM, the ++ * 32k sync timer. Convert the cycles elapsed since last read into ++ * nsecs and adds to a monotonically increasing timespec64. ++ */ ++static struct timespec64 persistent_ts; ++static cycles_t cycles; ++static unsigned int persistent_mult, persistent_shift; ++ ++static void omap_read_persistent_clock64(struct timespec64 *ts) ++{ ++ unsigned long long nsecs; ++ cycles_t last_cycles; ++ ++ last_cycles = cycles; ++ cycles = sync32k_cnt_reg ? readl_relaxed(sync32k_cnt_reg) : 0; ++ ++ nsecs = clocksource_cyc2ns(cycles - last_cycles, ++ persistent_mult, persistent_shift); ++ ++ timespec64_add_ns(&persistent_ts, nsecs); ++ ++ *ts = persistent_ts; ++} ++ ++/** ++ * omap_init_clocksource_32k - setup and register counter 32k as a ++ * kernel clocksource ++ * @pbase: base addr of counter_32k module ++ * @size: size of counter_32k to map ++ * ++ * Returns 0 upon success or negative error code upon failure. ++ * ++ */ ++int __init omap_init_clocksource_32k(void __iomem *vbase) ++{ ++ int ret; ++ ++ /* ++ * 32k sync Counter IP register offsets vary between the ++ * highlander version and the legacy ones. ++ * The 'SCHEME' bits(30-31) of the revision register is used ++ * to identify the version. ++ */ ++ if (readl_relaxed(vbase + OMAP2_32KSYNCNT_REV_OFF) & ++ OMAP2_32KSYNCNT_REV_SCHEME) ++ sync32k_cnt_reg = vbase + OMAP2_32KSYNCNT_CR_OFF_HIGH; ++ else ++ sync32k_cnt_reg = vbase + OMAP2_32KSYNCNT_CR_OFF_LOW; ++ ++ /* ++ * 120000 rough estimate from the calculations in ++ * __clocksource_update_freq_scale. ++ */ ++ clocks_calc_mult_shift(&persistent_mult, &persistent_shift, ++ 32768, NSEC_PER_SEC, 120000); ++ ++ ret = clocksource_mmio_init(sync32k_cnt_reg, "32k_counter", 32768, ++ 250, 32, clocksource_mmio_readl_up); ++ if (ret) { ++ pr_err("32k_counter: can't register clocksource\n"); ++ return ret; ++ } ++ ++ sched_clock_register(omap_32k_read_sched_clock, 32, 32768); ++ register_persistent_clock(omap_read_persistent_clock64); ++ pr_info("OMAP clocksource: 32k_counter at 32768 Hz\n"); ++ ++ return 0; ++} ++ + /* + * --------------------------------------------------------------------------- + * Timer initialization +diff --git a/arch/arm/plat-omap/Kconfig b/arch/arm/plat-omap/Kconfig +index 93fd7fc537cf4..faae8557cd12b 100644 +--- a/arch/arm/plat-omap/Kconfig ++++ b/arch/arm/plat-omap/Kconfig +@@ -72,23 +72,6 @@ config OMAP_MPU_TIMER + timer provides more intra-tick resolution than the 32KHz timer, + but consumes more power. + +-config OMAP_32K_TIMER +- bool "Use 32KHz timer" +- depends on ARCH_OMAP16XX || ARCH_OMAP2PLUS +- default y if (ARCH_OMAP16XX || ARCH_OMAP2PLUS) +- help +- Select this option if you want to enable the OMAP 32KHz timer. +- This timer saves power compared to the OMAP_MPU_TIMER, and has +- support for no tick during idle. The 32KHz timer provides less +- intra-tick resolution than OMAP_MPU_TIMER. The 32KHz timer is +- currently only available for OMAP16XX, 24XX, 34XX, OMAP4/5 and DRA7XX. +- +- On OMAP2PLUS this value is only used for CONFIG_HZ and +- CLOCK_TICK_RATE compile time calculation. +- The actual timer selection is done in the board file +- through the (DT_)MACHINE_START structure. +- +- + config OMAP3_L2_AUX_SECURE_SAVE_RESTORE + bool "OMAP3 HS/EMU save and restore for L2 AUX control register" + depends on ARCH_OMAP3 && PM +diff --git a/arch/arm/plat-omap/Makefile b/arch/arm/plat-omap/Makefile +index 371f2ed00eda2..98a7b607873a2 100644 +--- a/arch/arm/plat-omap/Makefile ++++ b/arch/arm/plat-omap/Makefile +@@ -6,7 +6,7 @@ + ccflags-$(CONFIG_ARCH_MULTIPLATFORM) := -I$(srctree)/arch/arm/plat-omap/include + + # Common support +-obj-y := sram.o dma.o counter_32k.o ++obj-y := sram.o dma.o + + # omap_device support (OMAP2+ only at the moment) + +diff --git a/arch/arm/plat-omap/counter_32k.c b/arch/arm/plat-omap/counter_32k.c +deleted file mode 100644 +index 7a729ade21057..0000000000000 +--- a/arch/arm/plat-omap/counter_32k.c ++++ /dev/null +@@ -1,114 +0,0 @@ +-// SPDX-License-Identifier: GPL-2.0-only +-/* +- * OMAP 32ksynctimer/counter_32k-related code +- * +- * Copyright (C) 2009 Texas Instruments +- * Copyright (C) 2010 Nokia Corporation +- * Tony Lindgren +- * Added OMAP4 support - Santosh Shilimkar +- * +- * NOTE: This timer is not the same timer as the old OMAP1 MPU timer. +- */ +-#include +-#include +-#include +-#include +-#include +-#include +-#include +- +-#include +- +-#include +- +-/* OMAP2_32KSYNCNT_CR_OFF: offset of 32ksync counter register */ +-#define OMAP2_32KSYNCNT_REV_OFF 0x0 +-#define OMAP2_32KSYNCNT_REV_SCHEME (0x3 << 30) +-#define OMAP2_32KSYNCNT_CR_OFF_LOW 0x10 +-#define OMAP2_32KSYNCNT_CR_OFF_HIGH 0x30 +- +-/* +- * 32KHz clocksource ... always available, on pretty most chips except +- * OMAP 730 and 1510. Other timers could be used as clocksources, with +- * higher resolution in free-running counter modes (e.g. 12 MHz xtal), +- * but systems won't necessarily want to spend resources that way. +- */ +-static void __iomem *sync32k_cnt_reg; +- +-static u64 notrace omap_32k_read_sched_clock(void) +-{ +- return sync32k_cnt_reg ? readl_relaxed(sync32k_cnt_reg) : 0; +-} +- +-/** +- * omap_read_persistent_clock64 - Return time from a persistent clock. +- * +- * Reads the time from a source which isn't disabled during PM, the +- * 32k sync timer. Convert the cycles elapsed since last read into +- * nsecs and adds to a monotonically increasing timespec64. +- */ +-static struct timespec64 persistent_ts; +-static cycles_t cycles; +-static unsigned int persistent_mult, persistent_shift; +- +-static void omap_read_persistent_clock64(struct timespec64 *ts) +-{ +- unsigned long long nsecs; +- cycles_t last_cycles; +- +- last_cycles = cycles; +- cycles = sync32k_cnt_reg ? readl_relaxed(sync32k_cnt_reg) : 0; +- +- nsecs = clocksource_cyc2ns(cycles - last_cycles, +- persistent_mult, persistent_shift); +- +- timespec64_add_ns(&persistent_ts, nsecs); +- +- *ts = persistent_ts; +-} +- +-/** +- * omap_init_clocksource_32k - setup and register counter 32k as a +- * kernel clocksource +- * @pbase: base addr of counter_32k module +- * @size: size of counter_32k to map +- * +- * Returns 0 upon success or negative error code upon failure. +- * +- */ +-int __init omap_init_clocksource_32k(void __iomem *vbase) +-{ +- int ret; +- +- /* +- * 32k sync Counter IP register offsets vary between the +- * highlander version and the legacy ones. +- * The 'SCHEME' bits(30-31) of the revision register is used +- * to identify the version. +- */ +- if (readl_relaxed(vbase + OMAP2_32KSYNCNT_REV_OFF) & +- OMAP2_32KSYNCNT_REV_SCHEME) +- sync32k_cnt_reg = vbase + OMAP2_32KSYNCNT_CR_OFF_HIGH; +- else +- sync32k_cnt_reg = vbase + OMAP2_32KSYNCNT_CR_OFF_LOW; +- +- /* +- * 120000 rough estimate from the calculations in +- * __clocksource_update_freq_scale. +- */ +- clocks_calc_mult_shift(&persistent_mult, &persistent_shift, +- 32768, NSEC_PER_SEC, 120000); +- +- ret = clocksource_mmio_init(sync32k_cnt_reg, "32k_counter", 32768, +- 250, 32, clocksource_mmio_readl_up); +- if (ret) { +- pr_err("32k_counter: can't register clocksource\n"); +- return ret; +- } +- +- sched_clock_register(omap_32k_read_sched_clock, 32, 32768); +- register_persistent_clock(omap_read_persistent_clock64); +- pr_info("OMAP clocksource: 32k_counter at 32768 Hz\n"); +- +- return 0; +-} +diff --git a/arch/arm/plat-omap/include/plat/counter-32k.h b/arch/arm/plat-omap/include/plat/counter-32k.h +deleted file mode 100644 +index da000d482ff26..0000000000000 +--- a/arch/arm/plat-omap/include/plat/counter-32k.h ++++ /dev/null +@@ -1 +0,0 @@ +-int omap_init_clocksource_32k(void __iomem *vbase); +-- +2.42.0 + diff --git a/queue-5.4/gtp-fix-fragmentation-needed-check-with-gso.patch b/queue-5.4/gtp-fix-fragmentation-needed-check-with-gso.patch new file mode 100644 index 00000000000..d0b3e5ec61e --- /dev/null +++ b/queue-5.4/gtp-fix-fragmentation-needed-check-with-gso.patch @@ -0,0 +1,38 @@ +From 20fc6de0576798e5b43e153df2726f21bf3c32dc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 22 Oct 2023 22:25:18 +0200 +Subject: gtp: fix fragmentation needed check with gso + +From: Pablo Neira Ayuso + +[ Upstream commit 4530e5b8e2dad63dcad2206232dd86e4b1489b6c ] + +Call skb_gso_validate_network_len() to check if packet is over PMTU. + +Fixes: 459aa660eb1d ("gtp: add initial driver for datapath of GPRS Tunneling Protocol (GTP-U)") +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/gtp.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c +index 0409afe9a53d6..c2e649a4f1bf4 100644 +--- a/drivers/net/gtp.c ++++ b/drivers/net/gtp.c +@@ -544,8 +544,9 @@ static int gtp_build_skb_ip4(struct sk_buff *skb, struct net_device *dev, + + rt->dst.ops->update_pmtu(&rt->dst, NULL, skb, mtu, false); + +- if (!skb_is_gso(skb) && (iph->frag_off & htons(IP_DF)) && +- mtu < ntohs(iph->tot_len)) { ++ if (iph->frag_off & htons(IP_DF) && ++ ((!skb_is_gso(skb) && skb->len > mtu) || ++ (skb_is_gso(skb) && !skb_gso_validate_network_len(skb, mtu)))) { + netdev_dbg(dev, "packet too big, fragmentation needed\n"); + icmp_ndo_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, + htonl(mtu)); +-- +2.42.0 + diff --git a/queue-5.4/gtp-uapi-fix-gtpa_max.patch b/queue-5.4/gtp-uapi-fix-gtpa_max.patch new file mode 100644 index 00000000000..d74464f0509 --- /dev/null +++ b/queue-5.4/gtp-uapi-fix-gtpa_max.patch @@ -0,0 +1,34 @@ +From 82c30100a73e86409c5c2bd0a9bcdd5b33f63c98 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 22 Oct 2023 22:25:17 +0200 +Subject: gtp: uapi: fix GTPA_MAX + +From: Pablo Neira Ayuso + +[ Upstream commit adc8df12d91a2b8350b0cd4c7fec3e8546c9d1f8 ] + +Subtract one to __GTPA_MAX, otherwise GTPA_MAX is off by 2. + +Fixes: 459aa660eb1d ("gtp: add initial driver for datapath of GPRS Tunneling Protocol (GTP-U)") +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + include/uapi/linux/gtp.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/uapi/linux/gtp.h b/include/uapi/linux/gtp.h +index c7d66755d212b..78bd62014efd3 100644 +--- a/include/uapi/linux/gtp.h ++++ b/include/uapi/linux/gtp.h +@@ -30,6 +30,6 @@ enum gtp_attrs { + GTPA_PAD, + __GTPA_MAX, + }; +-#define GTPA_MAX (__GTPA_MAX + 1) ++#define GTPA_MAX (__GTPA_MAX - 1) + + #endif /* _UAPI_LINUX_GTP_H_ */ +-- +2.42.0 + diff --git a/queue-5.4/i40e-fix-wrong-check-for-i40e_txr_flags_wb_on_itr.patch b/queue-5.4/i40e-fix-wrong-check-for-i40e_txr_flags_wb_on_itr.patch new file mode 100644 index 00000000000..199408c8892 --- /dev/null +++ b/queue-5.4/i40e-fix-wrong-check-for-i40e_txr_flags_wb_on_itr.patch @@ -0,0 +1,38 @@ +From b8c5182eefa416526898de0b42105f2c8a60ed9a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 Oct 2023 14:27:14 -0700 +Subject: i40e: Fix wrong check for I40E_TXR_FLAGS_WB_ON_ITR + +From: Ivan Vecera + +[ Upstream commit 77a8c982ff0d4c3a14022c6fe9e3dbfb327552ec ] + +The I40E_TXR_FLAGS_WB_ON_ITR is i40e_ring flag and not i40e_pf one. + +Fixes: 8e0764b4d6be42 ("i40e/i40evf: Add support for writeback on ITR feature for X722") +Signed-off-by: Ivan Vecera +Tested-by: Pucha Himasekhar Reddy (A Contingent worker at Intel) +Signed-off-by: Jacob Keller +Link: https://lore.kernel.org/r/20231023212714.178032-1-jacob.e.keller@intel.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_txrx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.c b/drivers/net/ethernet/intel/i40e/i40e_txrx.c +index 06987913837aa..6067c88668341 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c +@@ -2669,7 +2669,7 @@ int i40e_napi_poll(struct napi_struct *napi, int budget) + return budget; + } + +- if (vsi->back->flags & I40E_TXR_FLAGS_WB_ON_ITR) ++ if (q_vector->tx.ring[0].flags & I40E_TXR_FLAGS_WB_ON_ITR) + q_vector->arm_wb_state = false; + + /* Exit the polling mode, but don't re-enable interrupts if stack might +-- +2.42.0 + diff --git a/queue-5.4/igb-fix-potential-memory-leak-in-igb_add_ethtool_nfc.patch b/queue-5.4/igb-fix-potential-memory-leak-in-igb_add_ethtool_nfc.patch new file mode 100644 index 00000000000..edf34dd18d2 --- /dev/null +++ b/queue-5.4/igb-fix-potential-memory-leak-in-igb_add_ethtool_nfc.patch @@ -0,0 +1,47 @@ +From 0d61148f9db4c7ad3ebc58bec00686de789c7bf6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Oct 2023 13:40:35 -0700 +Subject: igb: Fix potential memory leak in igb_add_ethtool_nfc_entry + +From: Mateusz Palczewski + +[ Upstream commit 8c0b48e01daba5ca58f939a8425855d3f4f2ed14 ] + +Add check for return of igb_update_ethtool_nfc_entry so that in case +of any potential errors the memory alocated for input will be freed. + +Fixes: 0e71def25281 ("igb: add support of RX network flow classification") +Reviewed-by: Wojciech Drewek +Signed-off-by: Mateusz Palczewski +Tested-by: Arpana Arland (A Contingent worker at Intel) +Signed-off-by: Jacob Keller +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/igb/igb_ethtool.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/igb/igb_ethtool.c b/drivers/net/ethernet/intel/igb/igb_ethtool.c +index 50f61b18ae1e3..de2c39436fe0a 100644 +--- a/drivers/net/ethernet/intel/igb/igb_ethtool.c ++++ b/drivers/net/ethernet/intel/igb/igb_ethtool.c +@@ -2997,11 +2997,15 @@ static int igb_add_ethtool_nfc_entry(struct igb_adapter *adapter, + if (err) + goto err_out_w_lock; + +- igb_update_ethtool_nfc_entry(adapter, input, input->sw_idx); ++ err = igb_update_ethtool_nfc_entry(adapter, input, input->sw_idx); ++ if (err) ++ goto err_out_input_filter; + + spin_unlock(&adapter->nfc_lock); + return 0; + ++err_out_input_filter: ++ igb_erase_filter(adapter, input); + err_out_w_lock: + spin_unlock(&adapter->nfc_lock); + err_out: +-- +2.42.0 + diff --git a/queue-5.4/igc-fix-ambiguity-in-the-ethtool-advertising.patch b/queue-5.4/igc-fix-ambiguity-in-the-ethtool-advertising.patch new file mode 100644 index 00000000000..e6c252920d5 --- /dev/null +++ b/queue-5.4/igc-fix-ambiguity-in-the-ethtool-advertising.patch @@ -0,0 +1,86 @@ +From b22b9bdc0278fd49cdc177c1f0b95c7731f8d6e6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Oct 2023 13:36:41 -0700 +Subject: igc: Fix ambiguity in the ethtool advertising + +From: Sasha Neftin + +[ Upstream commit e7684d29efdf37304c62bb337ea55b3428ca118e ] + +The 'ethtool_convert_link_mode_to_legacy_u32' method does not allow us to +advertise 2500M speed support and TP (twisted pair) properly. Convert to +'ethtool_link_ksettings_test_link_mode' to advertise supported speed and +eliminate ambiguity. + +Fixes: 8c5ad0dae93c ("igc: Add ethtool support") +Suggested-by: Dima Ruinskiy +Suggested-by: Vitaly Lifshits +Signed-off-by: Sasha Neftin +Tested-by: Naama Meir +Signed-off-by: Jacob Keller +Link: https://lore.kernel.org/r/20231019203641.3661960-1-jacob.e.keller@intel.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/igc/igc_ethtool.c | 35 ++++++++++++++------ + 1 file changed, 25 insertions(+), 10 deletions(-) + +diff --git a/drivers/net/ethernet/intel/igc/igc_ethtool.c b/drivers/net/ethernet/intel/igc/igc_ethtool.c +index 0a4e7f5f292ac..a307b737dd0c2 100644 +--- a/drivers/net/ethernet/intel/igc/igc_ethtool.c ++++ b/drivers/net/ethernet/intel/igc/igc_ethtool.c +@@ -1768,7 +1768,7 @@ static int igc_set_link_ksettings(struct net_device *netdev, + { + struct igc_adapter *adapter = netdev_priv(netdev); + struct igc_hw *hw = &adapter->hw; +- u32 advertising; ++ u16 advertised = 0; + + /* When adapter in resetting mode, autoneg/speed/duplex + * cannot be changed +@@ -1794,18 +1794,33 @@ static int igc_set_link_ksettings(struct net_device *netdev, + while (test_and_set_bit(__IGC_RESETTING, &adapter->state)) + usleep_range(1000, 2000); + +- ethtool_convert_link_mode_to_legacy_u32(&advertising, +- cmd->link_modes.advertising); +- /* Converting to legacy u32 drops ETHTOOL_LINK_MODE_2500baseT_Full_BIT. +- * We have to check this and convert it to ADVERTISE_2500_FULL +- * (aka ETHTOOL_LINK_MODE_2500baseX_Full_BIT) explicitly. +- */ +- if (ethtool_link_ksettings_test_link_mode(cmd, advertising, 2500baseT_Full)) +- advertising |= ADVERTISE_2500_FULL; ++ if (ethtool_link_ksettings_test_link_mode(cmd, advertising, ++ 2500baseT_Full)) ++ advertised |= ADVERTISE_2500_FULL; ++ ++ if (ethtool_link_ksettings_test_link_mode(cmd, advertising, ++ 1000baseT_Full)) ++ advertised |= ADVERTISE_1000_FULL; ++ ++ if (ethtool_link_ksettings_test_link_mode(cmd, advertising, ++ 100baseT_Full)) ++ advertised |= ADVERTISE_100_FULL; ++ ++ if (ethtool_link_ksettings_test_link_mode(cmd, advertising, ++ 100baseT_Half)) ++ advertised |= ADVERTISE_100_HALF; ++ ++ if (ethtool_link_ksettings_test_link_mode(cmd, advertising, ++ 10baseT_Full)) ++ advertised |= ADVERTISE_10_FULL; ++ ++ if (ethtool_link_ksettings_test_link_mode(cmd, advertising, ++ 10baseT_Half)) ++ advertised |= ADVERTISE_10_HALF; + + if (cmd->base.autoneg == AUTONEG_ENABLE) { + hw->mac.autoneg = 1; +- hw->phy.autoneg_advertised = advertising; ++ hw->phy.autoneg_advertised = advertised; + if (adapter->fc_autoneg) + hw->fc.requested_mode = igc_fc_default; + } else { +-- +2.42.0 + diff --git a/queue-5.4/neighbour-fix-various-data-races.patch b/queue-5.4/neighbour-fix-various-data-races.patch new file mode 100644 index 00000000000..d90b83e8025 --- /dev/null +++ b/queue-5.4/neighbour-fix-various-data-races.patch @@ -0,0 +1,176 @@ +From de7f45a76075337fbdb2c6f432eb20c763978080 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Oct 2023 12:21:04 +0000 +Subject: neighbour: fix various data-races + +From: Eric Dumazet + +[ Upstream commit a9beb7e81bcb876615e1fbb3c07f3f9dba69831f ] + +1) tbl->gc_thresh1, tbl->gc_thresh2, tbl->gc_thresh3 and tbl->gc_interval + can be written from sysfs. + +2) tbl->last_flush is read locklessly from neigh_alloc() + +3) tbl->proxy_queue.qlen is read locklessly from neightbl_fill_info() + +4) neightbl_fill_info() reads cpu stats that can be changed concurrently. + +Fixes: c7fb64db001f ("[NETLINK]: Neighbour table configuration and statistics via rtnetlink") +Signed-off-by: Eric Dumazet +Link: https://lore.kernel.org/r/20231019122104.1448310-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/core/neighbour.c | 67 +++++++++++++++++++++++--------------------- + 1 file changed, 35 insertions(+), 32 deletions(-) + +diff --git a/net/core/neighbour.c b/net/core/neighbour.c +index c0489d8812c0e..9d631b7adb7bf 100644 +--- a/net/core/neighbour.c ++++ b/net/core/neighbour.c +@@ -224,7 +224,8 @@ bool neigh_remove_one(struct neighbour *ndel, struct neigh_table *tbl) + + static int neigh_forced_gc(struct neigh_table *tbl) + { +- int max_clean = atomic_read(&tbl->gc_entries) - tbl->gc_thresh2; ++ int max_clean = atomic_read(&tbl->gc_entries) - ++ READ_ONCE(tbl->gc_thresh2); + unsigned long tref = jiffies - 5 * HZ; + struct neighbour *n, *tmp; + int shrunk = 0; +@@ -253,7 +254,7 @@ static int neigh_forced_gc(struct neigh_table *tbl) + } + } + +- tbl->last_flush = jiffies; ++ WRITE_ONCE(tbl->last_flush, jiffies); + + write_unlock_bh(&tbl->lock); + +@@ -409,17 +410,17 @@ static struct neighbour *neigh_alloc(struct neigh_table *tbl, + { + struct neighbour *n = NULL; + unsigned long now = jiffies; +- int entries; ++ int entries, gc_thresh3; + + if (exempt_from_gc) + goto do_alloc; + + entries = atomic_inc_return(&tbl->gc_entries) - 1; +- if (entries >= tbl->gc_thresh3 || +- (entries >= tbl->gc_thresh2 && +- time_after(now, tbl->last_flush + 5 * HZ))) { +- if (!neigh_forced_gc(tbl) && +- entries >= tbl->gc_thresh3) { ++ gc_thresh3 = READ_ONCE(tbl->gc_thresh3); ++ if (entries >= gc_thresh3 || ++ (entries >= READ_ONCE(tbl->gc_thresh2) && ++ time_after(now, READ_ONCE(tbl->last_flush) + 5 * HZ))) { ++ if (!neigh_forced_gc(tbl) && entries >= gc_thresh3) { + net_info_ratelimited("%s: neighbor table overflow!\n", + tbl->id); + NEIGH_CACHE_STAT_INC(tbl, table_fulls); +@@ -902,13 +903,14 @@ static void neigh_periodic_work(struct work_struct *work) + + if (time_after(jiffies, tbl->last_rand + 300 * HZ)) { + struct neigh_parms *p; +- tbl->last_rand = jiffies; ++ ++ WRITE_ONCE(tbl->last_rand, jiffies); + list_for_each_entry(p, &tbl->parms_list, list) + p->reachable_time = + neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME)); + } + +- if (atomic_read(&tbl->entries) < tbl->gc_thresh1) ++ if (atomic_read(&tbl->entries) < READ_ONCE(tbl->gc_thresh1)) + goto out; + + for (i = 0 ; i < (1 << nht->hash_shift); i++) { +@@ -2050,15 +2052,16 @@ static int neightbl_fill_info(struct sk_buff *skb, struct neigh_table *tbl, + ndtmsg->ndtm_pad2 = 0; + + if (nla_put_string(skb, NDTA_NAME, tbl->id) || +- nla_put_msecs(skb, NDTA_GC_INTERVAL, tbl->gc_interval, NDTA_PAD) || +- nla_put_u32(skb, NDTA_THRESH1, tbl->gc_thresh1) || +- nla_put_u32(skb, NDTA_THRESH2, tbl->gc_thresh2) || +- nla_put_u32(skb, NDTA_THRESH3, tbl->gc_thresh3)) ++ nla_put_msecs(skb, NDTA_GC_INTERVAL, READ_ONCE(tbl->gc_interval), ++ NDTA_PAD) || ++ nla_put_u32(skb, NDTA_THRESH1, READ_ONCE(tbl->gc_thresh1)) || ++ nla_put_u32(skb, NDTA_THRESH2, READ_ONCE(tbl->gc_thresh2)) || ++ nla_put_u32(skb, NDTA_THRESH3, READ_ONCE(tbl->gc_thresh3))) + goto nla_put_failure; + { + unsigned long now = jiffies; +- long flush_delta = now - tbl->last_flush; +- long rand_delta = now - tbl->last_rand; ++ long flush_delta = now - READ_ONCE(tbl->last_flush); ++ long rand_delta = now - READ_ONCE(tbl->last_rand); + struct neigh_hash_table *nht; + struct ndt_config ndc = { + .ndtc_key_len = tbl->key_len, +@@ -2066,7 +2069,7 @@ static int neightbl_fill_info(struct sk_buff *skb, struct neigh_table *tbl, + .ndtc_entries = atomic_read(&tbl->entries), + .ndtc_last_flush = jiffies_to_msecs(flush_delta), + .ndtc_last_rand = jiffies_to_msecs(rand_delta), +- .ndtc_proxy_qlen = tbl->proxy_queue.qlen, ++ .ndtc_proxy_qlen = READ_ONCE(tbl->proxy_queue.qlen), + }; + + rcu_read_lock_bh(); +@@ -2089,17 +2092,17 @@ static int neightbl_fill_info(struct sk_buff *skb, struct neigh_table *tbl, + struct neigh_statistics *st; + + st = per_cpu_ptr(tbl->stats, cpu); +- ndst.ndts_allocs += st->allocs; +- ndst.ndts_destroys += st->destroys; +- ndst.ndts_hash_grows += st->hash_grows; +- ndst.ndts_res_failed += st->res_failed; +- ndst.ndts_lookups += st->lookups; +- ndst.ndts_hits += st->hits; +- ndst.ndts_rcv_probes_mcast += st->rcv_probes_mcast; +- ndst.ndts_rcv_probes_ucast += st->rcv_probes_ucast; +- ndst.ndts_periodic_gc_runs += st->periodic_gc_runs; +- ndst.ndts_forced_gc_runs += st->forced_gc_runs; +- ndst.ndts_table_fulls += st->table_fulls; ++ ndst.ndts_allocs += READ_ONCE(st->allocs); ++ ndst.ndts_destroys += READ_ONCE(st->destroys); ++ ndst.ndts_hash_grows += READ_ONCE(st->hash_grows); ++ ndst.ndts_res_failed += READ_ONCE(st->res_failed); ++ ndst.ndts_lookups += READ_ONCE(st->lookups); ++ ndst.ndts_hits += READ_ONCE(st->hits); ++ ndst.ndts_rcv_probes_mcast += READ_ONCE(st->rcv_probes_mcast); ++ ndst.ndts_rcv_probes_ucast += READ_ONCE(st->rcv_probes_ucast); ++ ndst.ndts_periodic_gc_runs += READ_ONCE(st->periodic_gc_runs); ++ ndst.ndts_forced_gc_runs += READ_ONCE(st->forced_gc_runs); ++ ndst.ndts_table_fulls += READ_ONCE(st->table_fulls); + } + + if (nla_put_64bit(skb, NDTA_STATS, sizeof(ndst), &ndst, +@@ -2323,16 +2326,16 @@ static int neightbl_set(struct sk_buff *skb, struct nlmsghdr *nlh, + goto errout_tbl_lock; + + if (tb[NDTA_THRESH1]) +- tbl->gc_thresh1 = nla_get_u32(tb[NDTA_THRESH1]); ++ WRITE_ONCE(tbl->gc_thresh1, nla_get_u32(tb[NDTA_THRESH1])); + + if (tb[NDTA_THRESH2]) +- tbl->gc_thresh2 = nla_get_u32(tb[NDTA_THRESH2]); ++ WRITE_ONCE(tbl->gc_thresh2, nla_get_u32(tb[NDTA_THRESH2])); + + if (tb[NDTA_THRESH3]) +- tbl->gc_thresh3 = nla_get_u32(tb[NDTA_THRESH3]); ++ WRITE_ONCE(tbl->gc_thresh3, nla_get_u32(tb[NDTA_THRESH3])); + + if (tb[NDTA_GC_INTERVAL]) +- tbl->gc_interval = nla_get_msecs(tb[NDTA_GC_INTERVAL]); ++ WRITE_ONCE(tbl->gc_interval, nla_get_msecs(tb[NDTA_GC_INTERVAL])); + + err = 0; + +-- +2.42.0 + diff --git a/queue-5.4/net-ieee802154-adf7242-fix-some-potential-buffer-ove.patch b/queue-5.4/net-ieee802154-adf7242-fix-some-potential-buffer-ove.patch new file mode 100644 index 00000000000..aec5003c43c --- /dev/null +++ b/queue-5.4/net-ieee802154-adf7242-fix-some-potential-buffer-ove.patch @@ -0,0 +1,47 @@ +From 8e7d80cde8008e44a2a0edb32ea84e399f0bc34b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 21 Oct 2023 20:03:53 +0200 +Subject: net: ieee802154: adf7242: Fix some potential buffer overflow in + adf7242_stats_show() + +From: Christophe JAILLET + +[ Upstream commit ca082f019d8fbb983f03080487946da714154bae ] + +strncat() usage in adf7242_debugfs_init() is wrong. +The size given to strncat() is the maximum number of bytes that can be +written, excluding the trailing NULL. + +Here, the size that is passed, DNAME_INLINE_LEN, does not take into account +the size of "adf7242-" that is already in the array. + +In order to fix it, use snprintf() instead. + +Fixes: 7302b9d90117 ("ieee802154/adf7242: Driver for ADF7242 MAC IEEE802154") +Signed-off-by: Christophe JAILLET +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ieee802154/adf7242.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ieee802154/adf7242.c b/drivers/net/ieee802154/adf7242.c +index cb29da961e12b..179e3e42b5f03 100644 +--- a/drivers/net/ieee802154/adf7242.c ++++ b/drivers/net/ieee802154/adf7242.c +@@ -1162,9 +1162,10 @@ static int adf7242_stats_show(struct seq_file *file, void *offset) + + static void adf7242_debugfs_init(struct adf7242_local *lp) + { +- char debugfs_dir_name[DNAME_INLINE_LEN + 1] = "adf7242-"; ++ char debugfs_dir_name[DNAME_INLINE_LEN + 1]; + +- strncat(debugfs_dir_name, dev_name(&lp->spi->dev), DNAME_INLINE_LEN); ++ snprintf(debugfs_dir_name, sizeof(debugfs_dir_name), ++ "adf7242-%s", dev_name(&lp->spi->dev)); + + lp->debugfs_root = debugfs_create_dir(debugfs_dir_name, NULL); + +-- +2.42.0 + diff --git a/queue-5.4/r8152-cancel-hw_phy_work-if-we-have-an-error-in-prob.patch b/queue-5.4/r8152-cancel-hw_phy_work-if-we-have-an-error-in-prob.patch new file mode 100644 index 00000000000..e452b227fce --- /dev/null +++ b/queue-5.4/r8152-cancel-hw_phy_work-if-we-have-an-error-in-prob.patch @@ -0,0 +1,37 @@ +From cb2729ccc31ab794382c2430189d2cf778e93079 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Oct 2023 14:06:54 -0700 +Subject: r8152: Cancel hw_phy_work if we have an error in probe + +From: Douglas Anderson + +[ Upstream commit bb8adff9123e492598162ac1baad01a53891aef6 ] + +The error handling in rtl8152_probe() is missing a call to cancel the +hw_phy_work. Add it in to match what's in the cleanup code in +rtl8152_disconnect(). + +Fixes: a028a9e003f2 ("r8152: move the settings of PHY to a work queue") +Signed-off-by: Douglas Anderson +Reviewed-by: Grant Grundler +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/usb/r8152.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c +index 8f8ad48ffb011..472b02bcfcbf4 100644 +--- a/drivers/net/usb/r8152.c ++++ b/drivers/net/usb/r8152.c +@@ -5779,6 +5779,7 @@ static int rtl8152_probe(struct usb_interface *intf, + + out1: + tasklet_kill(&tp->tx_tl); ++ cancel_delayed_work_sync(&tp->hw_phy_work); + if (tp->rtl_ops.unload) + tp->rtl_ops.unload(tp); + usb_set_intfdata(intf, NULL); +-- +2.42.0 + diff --git a/queue-5.4/r8152-increase-usb-control-msg-timeout-to-5000ms-as-.patch b/queue-5.4/r8152-increase-usb-control-msg-timeout-to-5000ms-as-.patch new file mode 100644 index 00000000000..8f403c31eac --- /dev/null +++ b/queue-5.4/r8152-increase-usb-control-msg-timeout-to-5000ms-as-.patch @@ -0,0 +1,77 @@ +From a59209469a674eb82268f81db7fd267ed59cb202 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Oct 2023 14:06:52 -0700 +Subject: r8152: Increase USB control msg timeout to 5000ms as per spec + +From: Douglas Anderson + +[ Upstream commit a5feba71ec9c14a54c3babdc732c5b6866d8ee43 ] + +According to the comment next to USB_CTRL_GET_TIMEOUT and +USB_CTRL_SET_TIMEOUT, although sending/receiving control messages is +usually quite fast, the spec allows them to take up to 5 seconds. +Let's increase the timeout in the Realtek driver from 500ms to 5000ms +(using the #defines) to account for this. + +This is not just a theoretical change. The need for the longer timeout +was seen in testing. Specifically, if you drop a sc7180-trogdor based +Chromebook into the kdb debugger and then "go" again after sitting in +the debugger for a while, the next USB control message takes a long +time. Out of ~40 tests the slowest USB control message was 4.5 +seconds. + +While dropping into kdb is not exactly an end-user scenario, the above +is similar to what could happen due to an temporary interrupt storm, +what could happen if there was a host controller (HW or SW) issue, or +what could happen if the Realtek device got into a confused state and +needed time to recover. + +This change is fairly critical since the r8152 driver in Linux doesn't +expect register reads/writes (which are backed by USB control +messages) to fail. + +Fixes: ac718b69301c ("net/usb: new driver for RTL8152") +Suggested-by: Hayes Wang +Signed-off-by: Douglas Anderson +Reviewed-by: Grant Grundler +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/usb/r8152.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c +index a19f0431e6f99..fa13a19e844c1 100644 +--- a/drivers/net/usb/r8152.c ++++ b/drivers/net/usb/r8152.c +@@ -850,7 +850,7 @@ int get_registers(struct r8152 *tp, u16 value, u16 index, u16 size, void *data) + + ret = usb_control_msg(tp->udev, usb_rcvctrlpipe(tp->udev, 0), + RTL8152_REQ_GET_REGS, RTL8152_REQT_READ, +- value, index, tmp, size, 500); ++ value, index, tmp, size, USB_CTRL_GET_TIMEOUT); + if (ret < 0) + memset(data, 0xff, size); + else +@@ -873,7 +873,7 @@ int set_registers(struct r8152 *tp, u16 value, u16 index, u16 size, void *data) + + ret = usb_control_msg(tp->udev, usb_sndctrlpipe(tp->udev, 0), + RTL8152_REQ_SET_REGS, RTL8152_REQT_WRITE, +- value, index, tmp, size, 500); ++ value, index, tmp, size, USB_CTRL_SET_TIMEOUT); + + kfree(tmp); + +@@ -5584,7 +5584,8 @@ static u8 rtl_get_version(struct usb_interface *intf) + + ret = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0), + RTL8152_REQ_GET_REGS, RTL8152_REQT_READ, +- PLA_TCR0, MCU_TYPE_PLA, tmp, sizeof(*tmp), 500); ++ PLA_TCR0, MCU_TYPE_PLA, tmp, sizeof(*tmp), ++ USB_CTRL_GET_TIMEOUT); + if (ret > 0) + ocp_data = (__le32_to_cpu(*tmp) >> 16) & VERSION_MASK; + +-- +2.42.0 + diff --git a/queue-5.4/r8152-run-the-unload-routine-if-we-have-errors-durin.patch b/queue-5.4/r8152-run-the-unload-routine-if-we-have-errors-durin.patch new file mode 100644 index 00000000000..0480733a970 --- /dev/null +++ b/queue-5.4/r8152-run-the-unload-routine-if-we-have-errors-durin.patch @@ -0,0 +1,38 @@ +From b43c6a2743df47f0cf5d1f93eb2a08698062db89 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Oct 2023 14:06:53 -0700 +Subject: r8152: Run the unload routine if we have errors during probe + +From: Douglas Anderson + +[ Upstream commit 5dd17689526971c5ae12bc8398f34bd68cd0499e ] + +The rtl8152_probe() function lacks a call to the chip-specific +unload() routine when it sees an error in probe. Add it in to match +the cleanup code in rtl8152_disconnect(). + +Fixes: ac718b69301c ("net/usb: new driver for RTL8152") +Signed-off-by: Douglas Anderson +Reviewed-by: Grant Grundler +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/usb/r8152.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c +index fa13a19e844c1..8f8ad48ffb011 100644 +--- a/drivers/net/usb/r8152.c ++++ b/drivers/net/usb/r8152.c +@@ -5779,6 +5779,8 @@ static int rtl8152_probe(struct usb_interface *intf, + + out1: + tasklet_kill(&tp->tx_tl); ++ if (tp->rtl_ops.unload) ++ tp->rtl_ops.unload(tp); + usb_set_intfdata(intf, NULL); + out: + free_netdev(netdev); +-- +2.42.0 + diff --git a/queue-5.4/r8169-fix-the-kcsan-reported-data-race-in-rtl_rx-whi.patch b/queue-5.4/r8169-fix-the-kcsan-reported-data-race-in-rtl_rx-whi.patch new file mode 100644 index 00000000000..a56e8f7fed8 --- /dev/null +++ b/queue-5.4/r8169-fix-the-kcsan-reported-data-race-in-rtl_rx-whi.patch @@ -0,0 +1,105 @@ +From a77985653ec8fda005331dd1617bc818746746dc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Oct 2023 21:34:38 +0200 +Subject: r8169: fix the KCSAN reported data race in rtl_rx while reading + desc->opts1 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Mirsad Goran Todorovac + +[ Upstream commit f97eee484e71890131f9c563c5cc6d5a69e4308d ] + +KCSAN reported the following data-race bug: + +================================================================== +BUG: KCSAN: data-race in rtl8169_poll (drivers/net/ethernet/realtek/r8169_main.c:4430 drivers/net/ethernet/realtek/r8169_main.c:4583) r8169 + +race at unknown origin, with read to 0xffff888117e43510 of 4 bytes by interrupt on cpu 21: +rtl8169_poll (drivers/net/ethernet/realtek/r8169_main.c:4430 drivers/net/ethernet/realtek/r8169_main.c:4583) r8169 +__napi_poll (net/core/dev.c:6527) +net_rx_action (net/core/dev.c:6596 net/core/dev.c:6727) +__do_softirq (kernel/softirq.c:553) +__irq_exit_rcu (kernel/softirq.c:427 kernel/softirq.c:632) +irq_exit_rcu (kernel/softirq.c:647) +sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1074 (discriminator 14)) +asm_sysvec_apic_timer_interrupt (./arch/x86/include/asm/idtentry.h:645) +cpuidle_enter_state (drivers/cpuidle/cpuidle.c:291) +cpuidle_enter (drivers/cpuidle/cpuidle.c:390) +call_cpuidle (kernel/sched/idle.c:135) +do_idle (kernel/sched/idle.c:219 kernel/sched/idle.c:282) +cpu_startup_entry (kernel/sched/idle.c:378 (discriminator 1)) +start_secondary (arch/x86/kernel/smpboot.c:210 arch/x86/kernel/smpboot.c:294) +secondary_startup_64_no_verify (arch/x86/kernel/head_64.S:433) + +value changed: 0x80003fff -> 0x3402805f + +Reported by Kernel Concurrency Sanitizer on: +CPU: 21 PID: 0 Comm: swapper/21 Tainted: G L 6.6.0-rc2-kcsan-00143-gb5cbe7c00aa0 #41 +Hardware name: ASRock X670E PG Lightning/X670E PG Lightning, BIOS 1.21 04/26/2023 +================================================================== + +drivers/net/ethernet/realtek/r8169_main.c: +========================================== + 4429 + → 4430 status = le32_to_cpu(desc->opts1); + 4431 if (status & DescOwn) + 4432 break; + 4433 + 4434 /* This barrier is needed to keep us from reading + 4435 * any other fields out of the Rx descriptor until + 4436 * we know the status of DescOwn + 4437 */ + 4438 dma_rmb(); + 4439 + 4440 if (unlikely(status & RxRES)) { + 4441 if (net_ratelimit()) + 4442 netdev_warn(dev, "Rx ERROR. status = %08x\n", + +Marco Elver explained that dma_rmb() doesn't prevent the compiler to tear up the access to +desc->opts1 which can be written to concurrently. READ_ONCE() should prevent that from +happening: + + 4429 + → 4430 status = le32_to_cpu(READ_ONCE(desc->opts1)); + 4431 if (status & DescOwn) + 4432 break; + 4433 + +As the consequence of this fix, this KCSAN warning was eliminated. + +Fixes: 6202806e7c03a ("r8169: drop member opts1_mask from struct rtl8169_private") +Suggested-by: Marco Elver +Cc: Heiner Kallweit +Cc: nic_swsd@realtek.com +Cc: "David S. Miller" +Cc: Eric Dumazet +Cc: Jakub Kicinski +Cc: Paolo Abeni +Cc: netdev@vger.kernel.org +Link: https://lore.kernel.org/lkml/dc7fc8fa-4ea4-e9a9-30a6-7c83e6b53188@alu.unizg.hr/ +Signed-off-by: Mirsad Goran Todorovac +Acked-by: Marco Elver +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/realtek/r8169_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c +index b973198da96c3..fca2dbdd37aff 100644 +--- a/drivers/net/ethernet/realtek/r8169_main.c ++++ b/drivers/net/ethernet/realtek/r8169_main.c +@@ -6114,7 +6114,7 @@ static int rtl_rx(struct net_device *dev, struct rtl8169_private *tp, u32 budget + struct RxDesc *desc = tp->RxDescArray + entry; + u32 status; + +- status = le32_to_cpu(desc->opts1); ++ status = le32_to_cpu(READ_ONCE(desc->opts1)); + if (status & DescOwn) + break; + +-- +2.42.0 + diff --git a/queue-5.4/r8169-fix-the-kcsan-reported-data-race-in-rtl_tx-whi.patch b/queue-5.4/r8169-fix-the-kcsan-reported-data-race-in-rtl_tx-whi.patch new file mode 100644 index 00000000000..b11c76aa9ef --- /dev/null +++ b/queue-5.4/r8169-fix-the-kcsan-reported-data-race-in-rtl_tx-whi.patch @@ -0,0 +1,136 @@ +From c2f90a0ca65472c26d09631e5fea430a27dc6ec2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Oct 2023 21:34:36 +0200 +Subject: r8169: fix the KCSAN reported data-race in rtl_tx while reading + TxDescArray[entry].opts1 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Mirsad Goran Todorovac + +[ Upstream commit dcf75a0f6bc136de94e88178ae5f51b7f879abc9 ] + +KCSAN reported the following data-race: + +================================================================== +BUG: KCSAN: data-race in rtl8169_poll (drivers/net/ethernet/realtek/r8169_main.c:4368 drivers/net/ethernet/realtek/r8169_main.c:4581) r8169 + +race at unknown origin, with read to 0xffff888140d37570 of 4 bytes by interrupt on cpu 21: +rtl8169_poll (drivers/net/ethernet/realtek/r8169_main.c:4368 drivers/net/ethernet/realtek/r8169_main.c:4581) r8169 +__napi_poll (net/core/dev.c:6527) +net_rx_action (net/core/dev.c:6596 net/core/dev.c:6727) +__do_softirq (kernel/softirq.c:553) +__irq_exit_rcu (kernel/softirq.c:427 kernel/softirq.c:632) +irq_exit_rcu (kernel/softirq.c:647) +sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1074 (discriminator 14)) +asm_sysvec_apic_timer_interrupt (./arch/x86/include/asm/idtentry.h:645) +cpuidle_enter_state (drivers/cpuidle/cpuidle.c:291) +cpuidle_enter (drivers/cpuidle/cpuidle.c:390) +call_cpuidle (kernel/sched/idle.c:135) +do_idle (kernel/sched/idle.c:219 kernel/sched/idle.c:282) +cpu_startup_entry (kernel/sched/idle.c:378 (discriminator 1)) +start_secondary (arch/x86/kernel/smpboot.c:210 arch/x86/kernel/smpboot.c:294) +secondary_startup_64_no_verify (arch/x86/kernel/head_64.S:433) + +value changed: 0xb0000042 -> 0x00000000 + +Reported by Kernel Concurrency Sanitizer on: +CPU: 21 PID: 0 Comm: swapper/21 Tainted: G L 6.6.0-rc2-kcsan-00143-gb5cbe7c00aa0 #41 +Hardware name: ASRock X670E PG Lightning/X670E PG Lightning, BIOS 1.21 04/26/2023 +================================================================== + +The read side is in + +drivers/net/ethernet/realtek/r8169_main.c +========================================= + 4355 static void rtl_tx(struct net_device *dev, struct rtl8169_private *tp, + 4356 int budget) + 4357 { + 4358 unsigned int dirty_tx, bytes_compl = 0, pkts_compl = 0; + 4359 struct sk_buff *skb; + 4360 + 4361 dirty_tx = tp->dirty_tx; + 4362 + 4363 while (READ_ONCE(tp->cur_tx) != dirty_tx) { + 4364 unsigned int entry = dirty_tx % NUM_TX_DESC; + 4365 u32 status; + 4366 + → 4367 status = le32_to_cpu(tp->TxDescArray[entry].opts1); + 4368 if (status & DescOwn) + 4369 break; + 4370 + 4371 skb = tp->tx_skb[entry].skb; + 4372 rtl8169_unmap_tx_skb(tp, entry); + 4373 + 4374 if (skb) { + 4375 pkts_compl++; + 4376 bytes_compl += skb->len; + 4377 napi_consume_skb(skb, budget); + 4378 } + 4379 dirty_tx++; + 4380 } + 4381 + 4382 if (tp->dirty_tx != dirty_tx) { + 4383 dev_sw_netstats_tx_add(dev, pkts_compl, bytes_compl); + 4384 WRITE_ONCE(tp->dirty_tx, dirty_tx); + 4385 + 4386 netif_subqueue_completed_wake(dev, 0, pkts_compl, bytes_compl, + 4387 rtl_tx_slots_avail(tp), + 4388 R8169_TX_START_THRS); + 4389 /* + 4390 * 8168 hack: TxPoll requests are lost when the Tx packets are + 4391 * too close. Let's kick an extra TxPoll request when a burst + 4392 * of start_xmit activity is detected (if it is not detected, + 4393 * it is slow enough). -- FR + 4394 * If skb is NULL then we come here again once a tx irq is + 4395 * triggered after the last fragment is marked transmitted. + 4396 */ + 4397 if (READ_ONCE(tp->cur_tx) != dirty_tx && skb) + 4398 rtl8169_doorbell(tp); + 4399 } + 4400 } + +tp->TxDescArray[entry].opts1 is reported to have a data-race and READ_ONCE() fixes +this KCSAN warning. + + 4366 + → 4367 status = le32_to_cpu(READ_ONCE(tp->TxDescArray[entry].opts1)); + 4368 if (status & DescOwn) + 4369 break; + 4370 + +Cc: Heiner Kallweit +Cc: nic_swsd@realtek.com +Cc: "David S. Miller" +Cc: Eric Dumazet +Cc: Jakub Kicinski +Cc: Paolo Abeni +Cc: Marco Elver +Cc: netdev@vger.kernel.org +Link: https://lore.kernel.org/lkml/dc7fc8fa-4ea4-e9a9-30a6-7c83e6b53188@alu.unizg.hr/ +Signed-off-by: Mirsad Goran Todorovac +Acked-by: Marco Elver +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/realtek/r8169_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c +index 8d2b184ff5758..b973198da96c3 100644 +--- a/drivers/net/ethernet/realtek/r8169_main.c ++++ b/drivers/net/ethernet/realtek/r8169_main.c +@@ -6031,7 +6031,7 @@ static void rtl_tx(struct net_device *dev, struct rtl8169_private *tp, + struct ring_info *tx_skb = tp->tx_skb + entry; + u32 status; + +- status = le32_to_cpu(tp->TxDescArray[entry].opts1); ++ status = le32_to_cpu(READ_ONCE(tp->TxDescArray[entry].opts1)); + if (status & DescOwn) + break; + +-- +2.42.0 + diff --git a/queue-5.4/series b/queue-5.4/series index e379e7f716b..f300cc31b4e 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -4,3 +4,19 @@ mcb-return-actual-parsed-size-when-reading-chameleon.patch mcb-lpc-reallocate-memory-region-to-avoid-memory-ove.patch virtio_balloon-fix-endless-deflation-and-inflation-on-arm64.patch virtio-mmio-fix-memory-leak-of-vm_dev.patch +arm-omap1-move-32k-counter-from-plat-omap-to-mach-om.patch +arm-omap-timer32k-fix-all-kernel-doc-warnings.patch +r8169-fix-the-kcsan-reported-data-race-in-rtl_tx-whi.patch +r8169-fix-the-kcsan-reported-data-race-in-rtl_rx-whi.patch +treewide-spelling-fix-in-comment.patch +igb-fix-potential-memory-leak-in-igb_add_ethtool_nfc.patch +neighbour-fix-various-data-races.patch +igc-fix-ambiguity-in-the-ethtool-advertising.patch +net-ieee802154-adf7242-fix-some-potential-buffer-ove.patch +r8152-increase-usb-control-msg-timeout-to-5000ms-as-.patch +r8152-run-the-unload-routine-if-we-have-errors-durin.patch +r8152-cancel-hw_phy_work-if-we-have-an-error-in-prob.patch +tcp-fix-wrong-rto-timeout-when-received-sack-renegin.patch +gtp-uapi-fix-gtpa_max.patch +gtp-fix-fragmentation-needed-check-with-gso.patch +i40e-fix-wrong-check-for-i40e_txr_flags_wb_on_itr.patch diff --git a/queue-5.4/tcp-fix-wrong-rto-timeout-when-received-sack-renegin.patch b/queue-5.4/tcp-fix-wrong-rto-timeout-when-received-sack-renegin.patch new file mode 100644 index 00000000000..9349e3b7ccc --- /dev/null +++ b/queue-5.4/tcp-fix-wrong-rto-timeout-when-received-sack-renegin.patch @@ -0,0 +1,96 @@ +From 702052a5e2809f8fada9f01e173e4a1597fdae9f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 21 Oct 2023 08:19:47 +0800 +Subject: tcp: fix wrong RTO timeout when received SACK reneging + +From: Fred Chen + +[ Upstream commit d2a0fc372aca561556e765d0a9ec365c7c12f0ad ] + +This commit fix wrong RTO timeout when received SACK reneging. + +When an ACK arrived pointing to a SACK reneging, tcp_check_sack_reneging() +will rearm the RTO timer for min(1/2*srtt, 10ms) into to the future. + +But since the commit 62d9f1a6945b ("tcp: fix TLP timer not set when +CA_STATE changes from DISORDER to OPEN") merged, the tcp_set_xmit_timer() +is moved after tcp_fastretrans_alert()(which do the SACK reneging check), +so the RTO timeout will be overwrited by tcp_set_xmit_timer() with +icsk_rto instead of 1/2*srtt. + +Here is a packetdrill script to check this bug: +0 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3 ++0 bind(3, ..., ...) = 0 ++0 listen(3, 1) = 0 + +// simulate srtt to 100ms ++0 < S 0:0(0) win 32792 ++0 > S. 0:0(0) ack 1 ++.1 < . 1:1(0) ack 1 win 1024 + ++0 accept(3, ..., ...) = 4 + ++0 write(4, ..., 10000) = 10000 ++0 > P. 1:10001(10000) ack 1 + +// inject sack ++.1 < . 1:1(0) ack 1 win 257 ++0 > . 1:1001(1000) ack 1 + +// inject sack reneging ++.1 < . 1:1(0) ack 1001 win 257 + +// we expect rto fired in 1/2*srtt (50ms) ++.05 > . 1001:2001(1000) ack 1 + +This fix remove the FLAG_SET_XMIT_TIMER from ack_flag when +tcp_check_sack_reneging() set RTO timer with 1/2*srtt to avoid +being overwrited later. + +Fixes: 62d9f1a6945b ("tcp: fix TLP timer not set when CA_STATE changes from DISORDER to OPEN") +Signed-off-by: Fred Chen +Reviewed-by: Neal Cardwell +Tested-by: Neal Cardwell +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_input.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index ec3c23adbab44..c3f227c4c3567 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -2057,16 +2057,17 @@ void tcp_enter_loss(struct sock *sk) + * restore sanity to the SACK scoreboard. If the apparent reneging + * persists until this RTO then we'll clear the SACK scoreboard. + */ +-static bool tcp_check_sack_reneging(struct sock *sk, int flag) ++static bool tcp_check_sack_reneging(struct sock *sk, int *ack_flag) + { +- if (flag & FLAG_SACK_RENEGING && +- flag & FLAG_SND_UNA_ADVANCED) { ++ if (*ack_flag & FLAG_SACK_RENEGING && ++ *ack_flag & FLAG_SND_UNA_ADVANCED) { + struct tcp_sock *tp = tcp_sk(sk); + unsigned long delay = max(usecs_to_jiffies(tp->srtt_us >> 4), + msecs_to_jiffies(10)); + + inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS, + delay, TCP_RTO_MAX); ++ *ack_flag &= ~FLAG_SET_XMIT_TIMER; + return true; + } + return false; +@@ -2840,7 +2841,7 @@ static void tcp_fastretrans_alert(struct sock *sk, const u32 prior_snd_una, + tp->prior_ssthresh = 0; + + /* B. In all the states check for reneging SACKs. */ +- if (tcp_check_sack_reneging(sk, flag)) ++ if (tcp_check_sack_reneging(sk, ack_flag)) + return; + + /* C. Check consistency of the current state. */ +-- +2.42.0 + diff --git a/queue-5.4/treewide-spelling-fix-in-comment.patch b/queue-5.4/treewide-spelling-fix-in-comment.patch new file mode 100644 index 00000000000..1e6b7b7e8d3 --- /dev/null +++ b/queue-5.4/treewide-spelling-fix-in-comment.patch @@ -0,0 +1,36 @@ +From 4fa7f523eed4cc8a60289ec8087e4fa9ea178f91 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Oct 2023 17:31:56 +0800 +Subject: treewide: Spelling fix in comment + +From: Kunwu Chan + +[ Upstream commit fb71ba0ed8be9534493c80ba00142a64d9972a72 ] + +reques -> request + +Fixes: 09dde54c6a69 ("PS3: gelic: Add wireless support for PS3") +Signed-off-by: Kunwu Chan +Reviewed-by: Geert Uytterhoeven +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/toshiba/ps3_gelic_wireless.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/toshiba/ps3_gelic_wireless.c b/drivers/net/ethernet/toshiba/ps3_gelic_wireless.c +index 2db546b27ee00..411b2a6091c91 100644 +--- a/drivers/net/ethernet/toshiba/ps3_gelic_wireless.c ++++ b/drivers/net/ethernet/toshiba/ps3_gelic_wireless.c +@@ -1217,7 +1217,7 @@ static int gelic_wl_set_encodeext(struct net_device *netdev, + key_index = wl->current_key; + + if (!enc->length && (ext->ext_flags & IW_ENCODE_EXT_SET_TX_KEY)) { +- /* reques to change default key index */ ++ /* request to change default key index */ + pr_debug("%s: request to change default key to %d\n", + __func__, key_index); + wl->current_key = key_index; +-- +2.42.0 +