From: Sasha Levin Date: Sat, 4 Jan 2025 14:21:13 +0000 (-0500) Subject: Fixes for 6.1 X-Git-Tag: v5.4.289~56 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=7f2c8b2591cc6680d2cbd9a720946088a619583d;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.1 Signed-off-by: Sasha Levin --- diff --git a/queue-6.1/af_packet-fix-vlan_get_protocol_dgram-vs-msg_peek.patch b/queue-6.1/af_packet-fix-vlan_get_protocol_dgram-vs-msg_peek.patch new file mode 100644 index 00000000000..eb54f04cf72 --- /dev/null +++ b/queue-6.1/af_packet-fix-vlan_get_protocol_dgram-vs-msg_peek.patch @@ -0,0 +1,149 @@ +From 14bbdb279e57a69cbc1c707dcb53c85fefc84577 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Dec 2024 16:10:04 +0000 +Subject: af_packet: fix vlan_get_protocol_dgram() vs MSG_PEEK + +From: Eric Dumazet + +[ Upstream commit f91a5b8089389eb408501af2762f168c3aaa7b79 ] + +Blamed commit forgot MSG_PEEK case, allowing a crash [1] as found +by syzbot. + +Rework vlan_get_protocol_dgram() to not touch skb at all, +so that it can be used from many cpus on the same skb. + +Add a const qualifier to skb argument. + +[1] +skbuff: skb_under_panic: text:ffffffff8a8ccd05 len:29 put:14 head:ffff88807fc8e400 data:ffff88807fc8e3f4 tail:0x11 end:0x140 dev: +------------[ cut here ]------------ + kernel BUG at net/core/skbuff.c:206 ! +Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI +CPU: 1 UID: 0 PID: 5892 Comm: syz-executor883 Not tainted 6.13.0-rc4-syzkaller-00054-gd6ef8b40d075 #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 + RIP: 0010:skb_panic net/core/skbuff.c:206 [inline] + RIP: 0010:skb_under_panic+0x14b/0x150 net/core/skbuff.c:216 +Code: 0b 8d 48 c7 c6 86 d5 25 8e 48 8b 54 24 08 8b 0c 24 44 8b 44 24 04 4d 89 e9 50 41 54 41 57 41 56 e8 5a 69 79 f7 48 83 c4 20 90 <0f> 0b 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 +RSP: 0018:ffffc900038d7638 EFLAGS: 00010282 +RAX: 0000000000000087 RBX: dffffc0000000000 RCX: 609ffd18ea660600 +RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 +RBP: ffff88802483c8d0 R08: ffffffff817f0a8c R09: 1ffff9200071ae60 +R10: dffffc0000000000 R11: fffff5200071ae61 R12: 0000000000000140 +R13: ffff88807fc8e400 R14: ffff88807fc8e3f4 R15: 0000000000000011 +FS: 00007fbac5e006c0(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 00007fbac5e00d58 CR3: 000000001238e000 CR4: 00000000003526f0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +Call Trace: + + skb_push+0xe5/0x100 net/core/skbuff.c:2636 + vlan_get_protocol_dgram+0x165/0x290 net/packet/af_packet.c:585 + packet_recvmsg+0x948/0x1ef0 net/packet/af_packet.c:3552 + sock_recvmsg_nosec net/socket.c:1033 [inline] + sock_recvmsg+0x22f/0x280 net/socket.c:1055 + ____sys_recvmsg+0x1c6/0x480 net/socket.c:2803 + ___sys_recvmsg net/socket.c:2845 [inline] + do_recvmmsg+0x426/0xab0 net/socket.c:2940 + __sys_recvmmsg net/socket.c:3014 [inline] + __do_sys_recvmmsg net/socket.c:3037 [inline] + __se_sys_recvmmsg net/socket.c:3030 [inline] + __x64_sys_recvmmsg+0x199/0x250 net/socket.c:3030 + do_syscall_x64 arch/x86/entry/common.c:52 [inline] + do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + +Fixes: 79eecf631c14 ("af_packet: Handle outgoing VLAN packets without hardware offloading") +Reported-by: syzbot+74f70bb1cb968bf09e4f@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/netdev/6772c485.050a0220.2f3838.04c5.GAE@google.com/T/#u +Signed-off-by: Eric Dumazet +Cc: Chengen Du +Reviewed-by: Willem de Bruijn +Link: https://patch.msgid.link/20241230161004.2681892-2-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + include/linux/if_vlan.h | 16 +++++++++++++--- + net/packet/af_packet.c | 16 ++++------------ + 2 files changed, 17 insertions(+), 15 deletions(-) + +diff --git a/include/linux/if_vlan.h b/include/linux/if_vlan.h +index 83266201746c..9f7dbbb34094 100644 +--- a/include/linux/if_vlan.h ++++ b/include/linux/if_vlan.h +@@ -587,13 +587,16 @@ static inline int vlan_get_tag(const struct sk_buff *skb, u16 *vlan_tci) + * vlan_get_protocol - get protocol EtherType. + * @skb: skbuff to query + * @type: first vlan protocol ++ * @mac_offset: MAC offset + * @depth: buffer to store length of eth and vlan tags in bytes + * + * Returns the EtherType of the packet, regardless of whether it is + * vlan encapsulated (normal or hardware accelerated) or not. + */ +-static inline __be16 __vlan_get_protocol(const struct sk_buff *skb, __be16 type, +- int *depth) ++static inline __be16 __vlan_get_protocol_offset(const struct sk_buff *skb, ++ __be16 type, ++ int mac_offset, ++ int *depth) + { + unsigned int vlan_depth = skb->mac_len, parse_depth = VLAN_MAX_DEPTH; + +@@ -612,7 +615,8 @@ static inline __be16 __vlan_get_protocol(const struct sk_buff *skb, __be16 type, + do { + struct vlan_hdr vhdr, *vh; + +- vh = skb_header_pointer(skb, vlan_depth, sizeof(vhdr), &vhdr); ++ vh = skb_header_pointer(skb, mac_offset + vlan_depth, ++ sizeof(vhdr), &vhdr); + if (unlikely(!vh || !--parse_depth)) + return 0; + +@@ -627,6 +631,12 @@ static inline __be16 __vlan_get_protocol(const struct sk_buff *skb, __be16 type, + return type; + } + ++static inline __be16 __vlan_get_protocol(const struct sk_buff *skb, __be16 type, ++ int *depth) ++{ ++ return __vlan_get_protocol_offset(skb, type, 0, depth); ++} ++ + /** + * vlan_get_protocol - get protocol EtherType. + * @skb: skbuff to query +diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c +index 224ac9a3482c..f3bd3e126703 100644 +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -571,21 +571,13 @@ static u16 vlan_get_tci(const struct sk_buff *skb, struct net_device *dev) + return ntohs(vh->h_vlan_TCI); + } + +-static __be16 vlan_get_protocol_dgram(struct sk_buff *skb) ++static __be16 vlan_get_protocol_dgram(const struct sk_buff *skb) + { + __be16 proto = skb->protocol; + +- if (unlikely(eth_type_vlan(proto))) { +- u8 *skb_orig_data = skb->data; +- int skb_orig_len = skb->len; +- +- skb_push(skb, skb->data - skb_mac_header(skb)); +- proto = __vlan_get_protocol(skb, proto, NULL); +- if (skb_orig_data != skb->data) { +- skb->data = skb_orig_data; +- skb->len = skb_orig_len; +- } +- } ++ if (unlikely(eth_type_vlan(proto))) ++ proto = __vlan_get_protocol_offset(skb, proto, ++ skb_mac_offset(skb), NULL); + + return proto; + } +-- +2.39.5 + diff --git a/queue-6.1/af_packet-fix-vlan_get_tci-vs-msg_peek.patch b/queue-6.1/af_packet-fix-vlan_get_tci-vs-msg_peek.patch new file mode 100644 index 00000000000..e8409da0f7d --- /dev/null +++ b/queue-6.1/af_packet-fix-vlan_get_tci-vs-msg_peek.patch @@ -0,0 +1,102 @@ +From 1591aac1e8fbc14789b5a0c990de51369660148e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Dec 2024 16:10:03 +0000 +Subject: af_packet: fix vlan_get_tci() vs MSG_PEEK + +From: Eric Dumazet + +[ Upstream commit 77ee7a6d16b6ec07b5c3ae2b6b60a24c1afbed09 ] + +Blamed commit forgot MSG_PEEK case, allowing a crash [1] as found +by syzbot. + +Rework vlan_get_tci() to not touch skb at all, +so that it can be used from many cpus on the same skb. + +Add a const qualifier to skb argument. + +[1] +skbuff: skb_under_panic: text:ffffffff8a8da482 len:32 put:14 head:ffff88807a1d5800 data:ffff88807a1d5810 tail:0x14 end:0x140 dev: +------------[ cut here ]------------ + kernel BUG at net/core/skbuff.c:206 ! +Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI +CPU: 0 UID: 0 PID: 5880 Comm: syz-executor172 Not tainted 6.13.0-rc3-syzkaller-00762-g9268abe611b0 #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 + RIP: 0010:skb_panic net/core/skbuff.c:206 [inline] + RIP: 0010:skb_under_panic+0x14b/0x150 net/core/skbuff.c:216 +Code: 0b 8d 48 c7 c6 9e 6c 26 8e 48 8b 54 24 08 8b 0c 24 44 8b 44 24 04 4d 89 e9 50 41 54 41 57 41 56 e8 3a 5a 79 f7 48 83 c4 20 90 <0f> 0b 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 +RSP: 0018:ffffc90003baf5b8 EFLAGS: 00010286 +RAX: 0000000000000087 RBX: dffffc0000000000 RCX: 8565c1eec37aa000 +RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 +RBP: ffff88802616fb50 R08: ffffffff817f0a4c R09: 1ffff92000775e50 +R10: dffffc0000000000 R11: fffff52000775e51 R12: 0000000000000140 +R13: ffff88807a1d5800 R14: ffff88807a1d5810 R15: 0000000000000014 +FS: 00007fa03261f6c0(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 00007ffd65753000 CR3: 0000000031720000 CR4: 00000000003526f0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +Call Trace: + + skb_push+0xe5/0x100 net/core/skbuff.c:2636 + vlan_get_tci+0x272/0x550 net/packet/af_packet.c:565 + packet_recvmsg+0x13c9/0x1ef0 net/packet/af_packet.c:3616 + sock_recvmsg_nosec net/socket.c:1044 [inline] + sock_recvmsg+0x22f/0x280 net/socket.c:1066 + ____sys_recvmsg+0x1c6/0x480 net/socket.c:2814 + ___sys_recvmsg net/socket.c:2856 [inline] + do_recvmmsg+0x426/0xab0 net/socket.c:2951 + __sys_recvmmsg net/socket.c:3025 [inline] + __do_sys_recvmmsg net/socket.c:3048 [inline] + __se_sys_recvmmsg net/socket.c:3041 [inline] + __x64_sys_recvmmsg+0x199/0x250 net/socket.c:3041 + do_syscall_x64 arch/x86/entry/common.c:52 [inline] + do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 + +Fixes: 79eecf631c14 ("af_packet: Handle outgoing VLAN packets without hardware offloading") +Reported-by: syzbot+8400677f3fd43f37d3bc@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/netdev/6772c485.050a0220.2f3838.04c6.GAE@google.com/T/#u +Signed-off-by: Eric Dumazet +Cc: Chengen Du +Reviewed-by: Willem de Bruijn +Link: https://patch.msgid.link/20241230161004.2681892-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/packet/af_packet.c | 12 +++--------- + 1 file changed, 3 insertions(+), 9 deletions(-) + +diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c +index 9da9e41899c6..224ac9a3482c 100644 +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -541,10 +541,8 @@ static void *packet_current_frame(struct packet_sock *po, + return packet_lookup_frame(po, rb, rb->head, status); + } + +-static u16 vlan_get_tci(struct sk_buff *skb, struct net_device *dev) ++static u16 vlan_get_tci(const struct sk_buff *skb, struct net_device *dev) + { +- u8 *skb_orig_data = skb->data; +- int skb_orig_len = skb->len; + struct vlan_hdr vhdr, *vh; + unsigned int header_len; + +@@ -565,12 +563,8 @@ static u16 vlan_get_tci(struct sk_buff *skb, struct net_device *dev) + else + return 0; + +- skb_push(skb, skb->data - skb_mac_header(skb)); +- vh = skb_header_pointer(skb, header_len, sizeof(vhdr), &vhdr); +- if (skb_orig_data != skb->data) { +- skb->data = skb_orig_data; +- skb->len = skb_orig_len; +- } ++ vh = skb_header_pointer(skb, skb_mac_offset(skb) + header_len, ++ sizeof(vhdr), &vhdr); + if (unlikely(!vh)) + return 0; + +-- +2.39.5 + diff --git a/queue-6.1/alsa-usb-audio-us16x08-initialize-array-before-use.patch b/queue-6.1/alsa-usb-audio-us16x08-initialize-array-before-use.patch new file mode 100644 index 00000000000..9ef94e3ef73 --- /dev/null +++ b/queue-6.1/alsa-usb-audio-us16x08-initialize-array-before-use.patch @@ -0,0 +1,43 @@ +From e0705aa05bb6350c973115e4d5108a9d43c28e99 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 29 Dec 2024 11:32:42 +0530 +Subject: ALSA: usb-audio: US16x08: Initialize array before use + +From: Tanya Agarwal + +[ Upstream commit b06a6187ef983f501e93faa56209169752d3bde3 ] + +Initialize meter_urb array before use in mixer_us16x08.c. + +CID 1410197: (#1 of 1): Uninitialized scalar variable (UNINIT) +uninit_use_in_call: Using uninitialized value *meter_urb when +calling get_meter_levels_from_urb. + +Coverity Link: +https://scan7.scan.coverity.com/#/project-view/52849/11354?selectedIssue=1410197 + +Fixes: d2bb390a2081 ("ALSA: usb-audio: Tascam US-16x08 DSP mixer quirk") +Signed-off-by: Tanya Agarwal +Link: https://patch.msgid.link/20241229060240.1642-1-tanyaagarwal25699@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/mixer_us16x08.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/usb/mixer_us16x08.c b/sound/usb/mixer_us16x08.c +index 6eb7d93b358d..20ac32635f1f 100644 +--- a/sound/usb/mixer_us16x08.c ++++ b/sound/usb/mixer_us16x08.c +@@ -687,7 +687,7 @@ static int snd_us16x08_meter_get(struct snd_kcontrol *kcontrol, + struct usb_mixer_elem_info *elem = kcontrol->private_data; + struct snd_usb_audio *chip = elem->head.mixer->chip; + struct snd_us16x08_meter_store *store = elem->private_data; +- u8 meter_urb[64]; ++ u8 meter_urb[64] = {0}; + + switch (kcontrol->private_value) { + case 0: { +-- +2.39.5 + diff --git a/queue-6.1/drm-bridge-adv7511_audio-update-audio-infoframe-prop.patch b/queue-6.1/drm-bridge-adv7511_audio-update-audio-infoframe-prop.patch new file mode 100644 index 00000000000..a40521828cd --- /dev/null +++ b/queue-6.1/drm-bridge-adv7511_audio-update-audio-infoframe-prop.patch @@ -0,0 +1,74 @@ +From 116ae3c7901471a1dbc6fc515d973f974b1d73ca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Nov 2024 08:40:29 +0100 +Subject: drm/bridge: adv7511_audio: Update Audio InfoFrame properly + +From: Stefan Ekenberg + +[ Upstream commit 902806baf3c1e8383c1fe3ff0b6042b8cb5c2707 ] + +AUDIO_UPDATE bit (Bit 5 of MAIN register 0x4A) needs to be set to 1 +while updating Audio InfoFrame information and then set to 0 when done. +Otherwise partially updated Audio InfoFrames could be sent out. Two +cases where this rule were not followed are fixed: + - In adv7511_hdmi_hw_params() make sure AUDIO_UPDATE bit is updated + before/after setting ADV7511_REG_AUDIO_INFOFRAME. + - In audio_startup() use the correct register for clearing + AUDIO_UPDATE bit. + +The problem with corrupted audio infoframes were discovered by letting +a HDMI logic analyser check the output of ADV7535. + +Note that this patchs replaces writing REG_GC(1) with +REG_INFOFRAME_UPDATE. Bit 5 of REG_GC(1) is positioned within field +GC_PP[3:0] and that field doesn't control audio infoframe and is read- +only. My conclusion therefore was that the author if this code meant to +clear bit 5 of REG_INFOFRAME_UPDATE from the very beginning. + +Tested-by: Biju Das +Fixes: 53c515befe28 ("drm/bridge: adv7511: Add Audio support") +Signed-off-by: Stefan Ekenberg +Reviewed-by: Dmitry Baryshkov +Link: https://patchwork.freedesktop.org/patch/msgid/20241119-adv7511-audio-info-frame-v4-1-4ae68e76c89c@axis.com +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/adv7511/adv7511_audio.c | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/adv7511/adv7511_audio.c b/drivers/gpu/drm/bridge/adv7511/adv7511_audio.c +index 61f4a38e7d2b..8f786592143b 100644 +--- a/drivers/gpu/drm/bridge/adv7511/adv7511_audio.c ++++ b/drivers/gpu/drm/bridge/adv7511/adv7511_audio.c +@@ -153,7 +153,16 @@ static int adv7511_hdmi_hw_params(struct device *dev, void *data, + ADV7511_AUDIO_CFG3_LEN_MASK, len); + regmap_update_bits(adv7511->regmap, ADV7511_REG_I2C_FREQ_ID_CFG, + ADV7511_I2C_FREQ_ID_CFG_RATE_MASK, rate << 4); +- regmap_write(adv7511->regmap, 0x73, 0x1); ++ ++ /* send current Audio infoframe values while updating */ ++ regmap_update_bits(adv7511->regmap, ADV7511_REG_INFOFRAME_UPDATE, ++ BIT(5), BIT(5)); ++ ++ regmap_write(adv7511->regmap, ADV7511_REG_AUDIO_INFOFRAME(0), 0x1); ++ ++ /* use Audio infoframe updated info */ ++ regmap_update_bits(adv7511->regmap, ADV7511_REG_INFOFRAME_UPDATE, ++ BIT(5), 0); + + return 0; + } +@@ -184,8 +193,9 @@ static int audio_startup(struct device *dev, void *data) + regmap_update_bits(adv7511->regmap, ADV7511_REG_GC(0), + BIT(7) | BIT(6), BIT(7)); + /* use Audio infoframe updated info */ +- regmap_update_bits(adv7511->regmap, ADV7511_REG_GC(1), ++ regmap_update_bits(adv7511->regmap, ADV7511_REG_INFOFRAME_UPDATE, + BIT(5), 0); ++ + /* enable SPDIF receiver */ + if (adv7511->audio_source == ADV7511_AUDIO_SOURCE_SPDIF) + regmap_update_bits(adv7511->regmap, ADV7511_REG_AUDIO_CONFIG, +-- +2.39.5 + diff --git a/queue-6.1/drm-i915-dg1-fix-power-gate-sequence.patch b/queue-6.1/drm-i915-dg1-fix-power-gate-sequence.patch new file mode 100644 index 00000000000..1d16e85171b --- /dev/null +++ b/queue-6.1/drm-i915-dg1-fix-power-gate-sequence.patch @@ -0,0 +1,45 @@ +From a066bebfd9377c4d191cec2ed57442cac7f37aca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Dec 2024 16:00:19 -0500 +Subject: drm/i915/dg1: Fix power gate sequence. + +From: Rodrigo Vivi + +[ Upstream commit 20e7c5313ffbf11c34a46395345677adbe890bee ] + +sub-pipe PG is not present on DG1. Setting these bits can disable +other power gates and cause GPU hangs on video playbacks. + +VLK: 16314, 4304 + +Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/13381 +Fixes: 85a12d7eb8fe ("drm/i915/tgl: Fix Media power gate sequence.") +Cc: Vinay Belgaumkar +Cc: Himal Prasad Ghimiray +Reviewed-by: Vinay Belgaumkar +Reviewed-by: Himal Prasad Ghimiray +Link: https://patchwork.freedesktop.org/patch/msgid/20241219210019.70532-1-rodrigo.vivi@intel.com +Signed-off-by: Rodrigo Vivi +(cherry picked from commit de7061947b4ed4be857d452c60d5fb795831d79e) +Signed-off-by: Tvrtko Ursulin +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/gt/intel_rc6.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/i915/gt/intel_rc6.c b/drivers/gpu/drm/i915/gt/intel_rc6.c +index f8d0523f4c18..d1dcb018117d 100644 +--- a/drivers/gpu/drm/i915/gt/intel_rc6.c ++++ b/drivers/gpu/drm/i915/gt/intel_rc6.c +@@ -134,7 +134,7 @@ static void gen11_rc6_enable(struct intel_rc6 *rc6) + GEN9_MEDIA_PG_ENABLE | + GEN11_MEDIA_SAMPLER_PG_ENABLE; + +- if (GRAPHICS_VER(gt->i915) >= 12) { ++ if (GRAPHICS_VER(gt->i915) >= 12 && !IS_DG1(gt->i915)) { + for (i = 0; i < I915_MAX_VCS; i++) + if (HAS_ENGINE(gt, _VCS(i))) + pg_enable |= (VDN_HCP_POWERGATE_ENABLE(i) | +-- +2.39.5 + diff --git a/queue-6.1/eth-bcmsysport-fix-call-balance-of-priv-clk-handling.patch b/queue-6.1/eth-bcmsysport-fix-call-balance-of-priv-clk-handling.patch new file mode 100644 index 00000000000..ab0f3d912df --- /dev/null +++ b/queue-6.1/eth-bcmsysport-fix-call-balance-of-priv-clk-handling.patch @@ -0,0 +1,82 @@ +From 967ca4b3e6d4632e3108e222205cd46963781519 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Dec 2024 15:30:07 +0300 +Subject: eth: bcmsysport: fix call balance of priv->clk handling routines + +From: Vitalii Mordan + +[ Upstream commit b255ef45fcc2141c1bf98456796abb956d843a27 ] + +Check the return value of clk_prepare_enable to ensure that priv->clk has +been successfully enabled. + +If priv->clk was not enabled during bcm_sysport_probe, bcm_sysport_resume, +or bcm_sysport_open, it must not be disabled in any subsequent execution +paths. + +Fixes: 31bc72d97656 ("net: systemport: fetch and use clock resources") +Signed-off-by: Vitalii Mordan +Reviewed-by: Florian Fainelli +Link: https://patch.msgid.link/20241227123007.2333397-1-mordan@ispras.ru +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bcmsysport.c | 21 ++++++++++++++++++--- + 1 file changed, 18 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c +index 1693f6c60efc..e53ab9b5482e 100644 +--- a/drivers/net/ethernet/broadcom/bcmsysport.c ++++ b/drivers/net/ethernet/broadcom/bcmsysport.c +@@ -1956,7 +1956,11 @@ static int bcm_sysport_open(struct net_device *dev) + unsigned int i; + int ret; + +- clk_prepare_enable(priv->clk); ++ ret = clk_prepare_enable(priv->clk); ++ if (ret) { ++ netdev_err(dev, "could not enable priv clock\n"); ++ return ret; ++ } + + /* Reset UniMAC */ + umac_reset(priv); +@@ -2614,7 +2618,11 @@ static int bcm_sysport_probe(struct platform_device *pdev) + goto err_deregister_notifier; + } + +- clk_prepare_enable(priv->clk); ++ ret = clk_prepare_enable(priv->clk); ++ if (ret) { ++ dev_err(&pdev->dev, "could not enable priv clock\n"); ++ goto err_deregister_netdev; ++ } + + priv->rev = topctrl_readl(priv, REV_CNTL) & REV_MASK; + dev_info(&pdev->dev, +@@ -2628,6 +2636,8 @@ static int bcm_sysport_probe(struct platform_device *pdev) + + return 0; + ++err_deregister_netdev: ++ unregister_netdev(dev); + err_deregister_notifier: + unregister_netdevice_notifier(&priv->netdev_notifier); + err_deregister_fixed_link: +@@ -2799,7 +2809,12 @@ static int __maybe_unused bcm_sysport_resume(struct device *d) + if (!netif_running(dev)) + return 0; + +- clk_prepare_enable(priv->clk); ++ ret = clk_prepare_enable(priv->clk); ++ if (ret) { ++ netdev_err(dev, "could not enable priv clock\n"); ++ return ret; ++ } ++ + if (priv->wolopts) + clk_disable_unprepare(priv->wol_clk); + +-- +2.39.5 + diff --git a/queue-6.1/ila-serialize-calls-to-nf_register_net_hooks.patch b/queue-6.1/ila-serialize-calls-to-nf_register_net_hooks.patch new file mode 100644 index 00000000000..e8421b2a00b --- /dev/null +++ b/queue-6.1/ila-serialize-calls-to-nf_register_net_hooks.patch @@ -0,0 +1,113 @@ +From 6aad491964307de28af3662021bbac8b63ddda90 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Dec 2024 16:28:49 +0000 +Subject: ila: serialize calls to nf_register_net_hooks() + +From: Eric Dumazet + +[ Upstream commit 260466b576bca0081a7d4acecc8e93687aa22d0e ] + +syzbot found a race in ila_add_mapping() [1] + +commit 031ae72825ce ("ila: call nf_unregister_net_hooks() sooner") +attempted to fix a similar issue. + +Looking at the syzbot repro, we have concurrent ILA_CMD_ADD commands. + +Add a mutex to make sure at most one thread is calling nf_register_net_hooks(). + +[1] + BUG: KASAN: slab-use-after-free in rht_key_hashfn include/linux/rhashtable.h:159 [inline] + BUG: KASAN: slab-use-after-free in __rhashtable_lookup.constprop.0+0x426/0x550 include/linux/rhashtable.h:604 +Read of size 4 at addr ffff888028f40008 by task dhcpcd/5501 + +CPU: 1 UID: 0 PID: 5501 Comm: dhcpcd Not tainted 6.13.0-rc4-syzkaller-00054-gd6ef8b40d075 #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 +Call Trace: + + __dump_stack lib/dump_stack.c:94 [inline] + dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 + print_address_description mm/kasan/report.c:378 [inline] + print_report+0xc3/0x620 mm/kasan/report.c:489 + kasan_report+0xd9/0x110 mm/kasan/report.c:602 + rht_key_hashfn include/linux/rhashtable.h:159 [inline] + __rhashtable_lookup.constprop.0+0x426/0x550 include/linux/rhashtable.h:604 + rhashtable_lookup include/linux/rhashtable.h:646 [inline] + rhashtable_lookup_fast include/linux/rhashtable.h:672 [inline] + ila_lookup_wildcards net/ipv6/ila/ila_xlat.c:127 [inline] + ila_xlat_addr net/ipv6/ila/ila_xlat.c:652 [inline] + ila_nf_input+0x1ee/0x620 net/ipv6/ila/ila_xlat.c:185 + nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] + nf_hook_slow+0xbb/0x200 net/netfilter/core.c:626 + nf_hook.constprop.0+0x42e/0x750 include/linux/netfilter.h:269 + NF_HOOK include/linux/netfilter.h:312 [inline] + ipv6_rcv+0xa4/0x680 net/ipv6/ip6_input.c:309 + __netif_receive_skb_one_core+0x12e/0x1e0 net/core/dev.c:5672 + __netif_receive_skb+0x1d/0x160 net/core/dev.c:5785 + process_backlog+0x443/0x15f0 net/core/dev.c:6117 + __napi_poll.constprop.0+0xb7/0x550 net/core/dev.c:6883 + napi_poll net/core/dev.c:6952 [inline] + net_rx_action+0xa94/0x1010 net/core/dev.c:7074 + handle_softirqs+0x213/0x8f0 kernel/softirq.c:561 + __do_softirq kernel/softirq.c:595 [inline] + invoke_softirq kernel/softirq.c:435 [inline] + __irq_exit_rcu+0x109/0x170 kernel/softirq.c:662 + irq_exit_rcu+0x9/0x30 kernel/softirq.c:678 + instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline] + sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1049 + +Fixes: 7f00feaf1076 ("ila: Add generic ILA translation facility") +Reported-by: syzbot+47e761d22ecf745f72b9@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/netdev/6772c9ae.050a0220.2f3838.04c7.GAE@google.com/T/#u +Signed-off-by: Eric Dumazet +Cc: Florian Westphal +Cc: Tom Herbert +Link: https://patch.msgid.link/20241230162849.2795486-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv6/ila/ila_xlat.c | 16 +++++++++++----- + 1 file changed, 11 insertions(+), 5 deletions(-) + +diff --git a/net/ipv6/ila/ila_xlat.c b/net/ipv6/ila/ila_xlat.c +index 2e7a36a1ea0a..8483116dfa23 100644 +--- a/net/ipv6/ila/ila_xlat.c ++++ b/net/ipv6/ila/ila_xlat.c +@@ -201,6 +201,8 @@ static const struct nf_hook_ops ila_nf_hook_ops[] = { + }, + }; + ++static DEFINE_MUTEX(ila_mutex); ++ + static int ila_add_mapping(struct net *net, struct ila_xlat_params *xp) + { + struct ila_net *ilan = net_generic(net, ila_net_id); +@@ -208,16 +210,20 @@ static int ila_add_mapping(struct net *net, struct ila_xlat_params *xp) + spinlock_t *lock = ila_get_lock(ilan, xp->ip.locator_match); + int err = 0, order; + +- if (!ilan->xlat.hooks_registered) { ++ if (!READ_ONCE(ilan->xlat.hooks_registered)) { + /* We defer registering net hooks in the namespace until the + * first mapping is added. + */ +- err = nf_register_net_hooks(net, ila_nf_hook_ops, +- ARRAY_SIZE(ila_nf_hook_ops)); ++ mutex_lock(&ila_mutex); ++ if (!ilan->xlat.hooks_registered) { ++ err = nf_register_net_hooks(net, ila_nf_hook_ops, ++ ARRAY_SIZE(ila_nf_hook_ops)); ++ if (!err) ++ WRITE_ONCE(ilan->xlat.hooks_registered, true); ++ } ++ mutex_unlock(&ila_mutex); + if (err) + return err; +- +- ilan->xlat.hooks_registered = true; + } + + ila = kzalloc(sizeof(*ila), GFP_KERNEL); +-- +2.39.5 + diff --git a/queue-6.1/ip_tunnel-annotate-data-races-around-t-parms.link.patch b/queue-6.1/ip_tunnel-annotate-data-races-around-t-parms.link.patch new file mode 100644 index 00000000000..67da6ed0195 --- /dev/null +++ b/queue-6.1/ip_tunnel-annotate-data-races-around-t-parms.link.patch @@ -0,0 +1,115 @@ +From 78c29e2a0d425d94537dd1097a8cc993605e4425 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Feb 2024 06:32:34 +0000 +Subject: ip_tunnel: annotate data-races around t->parms.link + +From: Eric Dumazet + +[ Upstream commit f694eee9e1c00d6ca06c5e59c04e3b6ff7d64aa9 ] + +t->parms.link is read locklessly, annotate these reads +and opposite writes accordingly. + +Signed-off-by: Eric Dumazet +Signed-off-by: David S. Miller +Stable-dep-of: b5a7b661a073 ("net: Fix netns for ip_tunnel_init_flow()") +Signed-off-by: Sasha Levin +--- + net/ipv4/ip_tunnel.c | 27 +++++++++++++-------------- + 1 file changed, 13 insertions(+), 14 deletions(-) + +diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c +index d56cfb6c3da4..196fe734ad38 100644 +--- a/net/ipv4/ip_tunnel.c ++++ b/net/ipv4/ip_tunnel.c +@@ -102,10 +102,9 @@ struct ip_tunnel *ip_tunnel_lookup(struct ip_tunnel_net *itn, + if (!ip_tunnel_key_match(&t->parms, flags, key)) + continue; + +- if (t->parms.link == link) ++ if (READ_ONCE(t->parms.link) == link) + return t; +- else +- cand = t; ++ cand = t; + } + + hlist_for_each_entry_rcu(t, head, hash_node) { +@@ -117,9 +116,9 @@ struct ip_tunnel *ip_tunnel_lookup(struct ip_tunnel_net *itn, + if (!ip_tunnel_key_match(&t->parms, flags, key)) + continue; + +- if (t->parms.link == link) ++ if (READ_ONCE(t->parms.link) == link) + return t; +- else if (!cand) ++ if (!cand) + cand = t; + } + +@@ -137,9 +136,9 @@ struct ip_tunnel *ip_tunnel_lookup(struct ip_tunnel_net *itn, + if (!ip_tunnel_key_match(&t->parms, flags, key)) + continue; + +- if (t->parms.link == link) ++ if (READ_ONCE(t->parms.link) == link) + return t; +- else if (!cand) ++ if (!cand) + cand = t; + } + +@@ -150,9 +149,9 @@ struct ip_tunnel *ip_tunnel_lookup(struct ip_tunnel_net *itn, + !(t->dev->flags & IFF_UP)) + continue; + +- if (t->parms.link == link) ++ if (READ_ONCE(t->parms.link) == link) + return t; +- else if (!cand) ++ if (!cand) + cand = t; + } + +@@ -221,7 +220,7 @@ static struct ip_tunnel *ip_tunnel_find(struct ip_tunnel_net *itn, + hlist_for_each_entry_rcu(t, head, hash_node) { + if (local == t->parms.iph.saddr && + remote == t->parms.iph.daddr && +- link == t->parms.link && ++ link == READ_ONCE(t->parms.link) && + type == t->dev->type && + ip_tunnel_key_match(&t->parms, flags, key)) + break; +@@ -774,7 +773,7 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev, + + ip_tunnel_init_flow(&fl4, protocol, dst, tnl_params->saddr, + tunnel->parms.o_key, RT_TOS(tos), +- dev_net(dev), tunnel->parms.link, ++ dev_net(dev), READ_ONCE(tunnel->parms.link), + tunnel->fwmark, skb_get_hash(skb), 0); + + if (ip_tunnel_encap(skb, &tunnel->encap, &protocol, &fl4) < 0) +@@ -894,7 +893,7 @@ static void ip_tunnel_update(struct ip_tunnel_net *itn, + if (t->parms.link != p->link || t->fwmark != fwmark) { + int mtu; + +- t->parms.link = p->link; ++ WRITE_ONCE(t->parms.link, p->link); + t->fwmark = fwmark; + mtu = ip_tunnel_bind_dev(dev); + if (set_mtu) +@@ -1084,9 +1083,9 @@ EXPORT_SYMBOL(ip_tunnel_get_link_net); + + int ip_tunnel_get_iflink(const struct net_device *dev) + { +- struct ip_tunnel *tunnel = netdev_priv(dev); ++ const struct ip_tunnel *tunnel = netdev_priv(dev); + +- return tunnel->parms.link; ++ return READ_ONCE(tunnel->parms.link); + } + EXPORT_SYMBOL(ip_tunnel_get_iflink); + +-- +2.39.5 + diff --git a/queue-6.1/ipip-ip_tunnel-sit-add-fou-support-for-externally-co.patch b/queue-6.1/ipip-ip_tunnel-sit-add-fou-support-for-externally-co.patch new file mode 100644 index 00000000000..46ece2270e4 --- /dev/null +++ b/queue-6.1/ipip-ip_tunnel-sit-add-fou-support-for-externally-co.patch @@ -0,0 +1,196 @@ +From 79c5da8bae4167890b64a888990d2346df9058fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Apr 2023 15:38:53 +0200 +Subject: ipip,ip_tunnel,sit: Add FOU support for externally controlled ipip + devices + +From: Christian Ehrig + +[ Upstream commit ac931d4cdec3df8b6eac3bc40a6871123021f078 ] + +Today ipip devices in collect-metadata mode don't allow for sending FOU +or GUE encapsulated packets. This patch lifts the restriction by adding +a struct ip_tunnel_encap to the tunnel metadata. + +On the egress path, the members of this struct can be set by the +bpf_skb_set_fou_encap kfunc via a BPF tc-hook. Instead of dropping packets +wishing to use additional UDP encapsulation, ip_md_tunnel_xmit now +evaluates the contents of this struct and adds the corresponding FOU or +GUE header. Furthermore, it is making sure that additional header bytes +are taken into account for PMTU discovery. + +On the ingress path, an ipip device in collect-metadata mode will fill this +struct and a BPF tc-hook can obtain the information via a call to the +bpf_skb_get_fou_encap kfunc. + +The minor change to ip_tunnel_encap, which now takes a pointer to +struct ip_tunnel_encap instead of struct ip_tunnel, allows us to control +FOU encap type and parameters on a per packet-level. + +Signed-off-by: Christian Ehrig +Link: https://lore.kernel.org/r/cfea47de655d0f870248abf725932f851b53960a.1680874078.git.cehrig@cloudflare.com +Signed-off-by: Alexei Starovoitov +Stable-dep-of: b5a7b661a073 ("net: Fix netns for ip_tunnel_init_flow()") +Signed-off-by: Sasha Levin +--- + include/net/ip_tunnels.h | 28 +++++++++++++++------------- + net/ipv4/ip_tunnel.c | 22 ++++++++++++++++++++-- + net/ipv4/ipip.c | 1 + + net/ipv6/sit.c | 2 +- + 4 files changed, 37 insertions(+), 16 deletions(-) + +diff --git a/include/net/ip_tunnels.h b/include/net/ip_tunnels.h +index f1ba369306fe..84751313b826 100644 +--- a/include/net/ip_tunnels.h ++++ b/include/net/ip_tunnels.h +@@ -57,6 +57,13 @@ struct ip_tunnel_key { + __u8 flow_flags; + }; + ++struct ip_tunnel_encap { ++ u16 type; ++ u16 flags; ++ __be16 sport; ++ __be16 dport; ++}; ++ + /* Flags for ip_tunnel_info mode. */ + #define IP_TUNNEL_INFO_TX 0x01 /* represents tx tunnel parameters */ + #define IP_TUNNEL_INFO_IPV6 0x02 /* key contains IPv6 addresses */ +@@ -66,9 +73,9 @@ struct ip_tunnel_key { + #define IP_TUNNEL_OPTS_MAX \ + GENMASK((sizeof_field(struct ip_tunnel_info, \ + options_len) * BITS_PER_BYTE) - 1, 0) +- + struct ip_tunnel_info { + struct ip_tunnel_key key; ++ struct ip_tunnel_encap encap; + #ifdef CONFIG_DST_CACHE + struct dst_cache dst_cache; + #endif +@@ -86,13 +93,6 @@ struct ip_tunnel_6rd_parm { + }; + #endif + +-struct ip_tunnel_encap { +- u16 type; +- u16 flags; +- __be16 sport; +- __be16 dport; +-}; +- + struct ip_tunnel_prl_entry { + struct ip_tunnel_prl_entry __rcu *next; + __be32 addr; +@@ -293,6 +293,7 @@ struct ip_tunnel *ip_tunnel_lookup(struct ip_tunnel_net *itn, + __be32 remote, __be32 local, + __be32 key); + ++void ip_tunnel_md_udp_encap(struct sk_buff *skb, struct ip_tunnel_info *info); + int ip_tunnel_rcv(struct ip_tunnel *tunnel, struct sk_buff *skb, + const struct tnl_ptk_info *tpi, struct metadata_dst *tun_dst, + bool log_ecn_error); +@@ -405,22 +406,23 @@ static inline int ip_encap_hlen(struct ip_tunnel_encap *e) + return hlen; + } + +-static inline int ip_tunnel_encap(struct sk_buff *skb, struct ip_tunnel *t, ++static inline int ip_tunnel_encap(struct sk_buff *skb, ++ struct ip_tunnel_encap *e, + u8 *protocol, struct flowi4 *fl4) + { + const struct ip_tunnel_encap_ops *ops; + int ret = -EINVAL; + +- if (t->encap.type == TUNNEL_ENCAP_NONE) ++ if (e->type == TUNNEL_ENCAP_NONE) + return 0; + +- if (t->encap.type >= MAX_IPTUN_ENCAP_OPS) ++ if (e->type >= MAX_IPTUN_ENCAP_OPS) + return -EINVAL; + + rcu_read_lock(); +- ops = rcu_dereference(iptun_encaps[t->encap.type]); ++ ops = rcu_dereference(iptun_encaps[e->type]); + if (likely(ops && ops->build_header)) +- ret = ops->build_header(skb, &t->encap, protocol, fl4); ++ ret = ops->build_header(skb, e, protocol, fl4); + rcu_read_unlock(); + + return ret; +diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c +index 3445e576b05b..d56cfb6c3da4 100644 +--- a/net/ipv4/ip_tunnel.c ++++ b/net/ipv4/ip_tunnel.c +@@ -359,6 +359,20 @@ static struct ip_tunnel *ip_tunnel_create(struct net *net, + return ERR_PTR(err); + } + ++void ip_tunnel_md_udp_encap(struct sk_buff *skb, struct ip_tunnel_info *info) ++{ ++ const struct iphdr *iph = ip_hdr(skb); ++ const struct udphdr *udph; ++ ++ if (iph->protocol != IPPROTO_UDP) ++ return; ++ ++ udph = (struct udphdr *)((__u8 *)iph + (iph->ihl << 2)); ++ info->encap.sport = udph->source; ++ info->encap.dport = udph->dest; ++} ++EXPORT_SYMBOL(ip_tunnel_md_udp_encap); ++ + int ip_tunnel_rcv(struct ip_tunnel *tunnel, struct sk_buff *skb, + const struct tnl_ptk_info *tpi, struct metadata_dst *tun_dst, + bool log_ecn_error) +@@ -599,7 +613,11 @@ void ip_md_tunnel_xmit(struct sk_buff *skb, struct net_device *dev, + tunnel_id_to_key32(key->tun_id), RT_TOS(tos), + dev_net(dev), 0, skb->mark, skb_get_hash(skb), + key->flow_flags); +- if (tunnel->encap.type != TUNNEL_ENCAP_NONE) ++ ++ if (!tunnel_hlen) ++ tunnel_hlen = ip_encap_hlen(&tun_info->encap); ++ ++ if (ip_tunnel_encap(skb, &tun_info->encap, &proto, &fl4) < 0) + goto tx_error; + + use_cache = ip_tunnel_dst_cache_usable(skb, tun_info); +@@ -759,7 +777,7 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev, + dev_net(dev), tunnel->parms.link, + tunnel->fwmark, skb_get_hash(skb), 0); + +- if (ip_tunnel_encap(skb, tunnel, &protocol, &fl4) < 0) ++ if (ip_tunnel_encap(skb, &tunnel->encap, &protocol, &fl4) < 0) + goto tx_error; + + if (connected && md) { +diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c +index 180f9daf5bec..1cf35c50cdf4 100644 +--- a/net/ipv4/ipip.c ++++ b/net/ipv4/ipip.c +@@ -241,6 +241,7 @@ static int ipip_tunnel_rcv(struct sk_buff *skb, u8 ipproto) + tun_dst = ip_tun_rx_dst(skb, 0, 0, 0); + if (!tun_dst) + return 0; ++ ip_tunnel_md_udp_encap(skb, &tun_dst->u.tun_info); + } + skb_reset_mac_header(skb); + +diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c +index 3ffb6a5b1f82..cc24cefdb85c 100644 +--- a/net/ipv6/sit.c ++++ b/net/ipv6/sit.c +@@ -1024,7 +1024,7 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb, + ttl = iph6->hop_limit; + tos = INET_ECN_encapsulate(tos, ipv6_get_dsfield(iph6)); + +- if (ip_tunnel_encap(skb, tunnel, &protocol, &fl4) < 0) { ++ if (ip_tunnel_encap(skb, &tunnel->encap, &protocol, &fl4) < 0) { + ip_rt_put(rt); + goto tx_error; + } +-- +2.39.5 + diff --git a/queue-6.1/ipv4-ip_tunnel-unmask-upper-dscp-bits-in-ip_md_tunne.patch b/queue-6.1/ipv4-ip_tunnel-unmask-upper-dscp-bits-in-ip_md_tunne.patch new file mode 100644 index 00000000000..c41b9fc794c --- /dev/null +++ b/queue-6.1/ipv4-ip_tunnel-unmask-upper-dscp-bits-in-ip_md_tunne.patch @@ -0,0 +1,54 @@ +From 05fb83647aff595e6e563953ad22d21f294f2f9d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Sep 2024 19:51:34 +0300 +Subject: ipv4: ip_tunnel: Unmask upper DSCP bits in ip_md_tunnel_xmit() + +From: Ido Schimmel + +[ Upstream commit c34cfe72bb260fc49660d9e6a9ba95ba01669ae2 ] + +Unmask the upper DSCP bits when initializing an IPv4 flow key via +ip_tunnel_init_flow() before passing it to ip_route_output_key() so that +in the future we could perform the FIB lookup according to the full DSCP +value. + +Note that the 'tos' variable includes the full DS field. Either the one +specified via the tunnel key or the one inherited from the inner packet. + +Signed-off-by: Ido Schimmel +Reviewed-by: Guillaume Nault +Signed-off-by: David S. Miller +Stable-dep-of: b5a7b661a073 ("net: Fix netns for ip_tunnel_init_flow()") +Signed-off-by: Sasha Levin +--- + net/ipv4/ip_tunnel.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c +index d3ad2c424fe9..eb74e33ffb64 100644 +--- a/net/ipv4/ip_tunnel.c ++++ b/net/ipv4/ip_tunnel.c +@@ -43,6 +43,7 @@ + #include + #include + #include ++#include + + #if IS_ENABLED(CONFIG_IPV6) + #include +@@ -609,9 +610,9 @@ void ip_md_tunnel_xmit(struct sk_buff *skb, struct net_device *dev, + tos = ipv6_get_dsfield((const struct ipv6hdr *)inner_iph); + } + ip_tunnel_init_flow(&fl4, proto, key->u.ipv4.dst, key->u.ipv4.src, +- tunnel_id_to_key32(key->tun_id), RT_TOS(tos), +- dev_net(dev), 0, skb->mark, skb_get_hash(skb), +- key->flow_flags); ++ tunnel_id_to_key32(key->tun_id), ++ tos & INET_DSCP_MASK, dev_net(dev), 0, skb->mark, ++ skb_get_hash(skb), key->flow_flags); + + if (!tunnel_hlen) + tunnel_hlen = ip_encap_hlen(&tun_info->encap); +-- +2.39.5 + diff --git a/queue-6.1/ipv4-ip_tunnel-unmask-upper-dscp-bits-in-ip_tunnel_b.patch b/queue-6.1/ipv4-ip_tunnel-unmask-upper-dscp-bits-in-ip_tunnel_b.patch new file mode 100644 index 00000000000..96146a36941 --- /dev/null +++ b/queue-6.1/ipv4-ip_tunnel-unmask-upper-dscp-bits-in-ip_tunnel_b.patch @@ -0,0 +1,39 @@ +From 4474f1b38bde4a4033f0337f06d07ebb32214f63 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Sep 2024 19:51:33 +0300 +Subject: ipv4: ip_tunnel: Unmask upper DSCP bits in ip_tunnel_bind_dev() + +From: Ido Schimmel + +[ Upstream commit e7191e517a03d025405c7df730b400ad4118474e ] + +Unmask the upper DSCP bits when initializing an IPv4 flow key via +ip_tunnel_init_flow() before passing it to ip_route_output_key() so that +in the future we could perform the FIB lookup according to the full DSCP +value. + +Signed-off-by: Ido Schimmel +Reviewed-by: Guillaume Nault +Signed-off-by: David S. Miller +Stable-dep-of: b5a7b661a073 ("net: Fix netns for ip_tunnel_init_flow()") +Signed-off-by: Sasha Levin +--- + net/ipv4/ip_tunnel.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c +index 196fe734ad38..d3ad2c424fe9 100644 +--- a/net/ipv4/ip_tunnel.c ++++ b/net/ipv4/ip_tunnel.c +@@ -293,7 +293,7 @@ static int ip_tunnel_bind_dev(struct net_device *dev) + + ip_tunnel_init_flow(&fl4, iph->protocol, iph->daddr, + iph->saddr, tunnel->parms.o_key, +- RT_TOS(iph->tos), dev_net(dev), ++ iph->tos & INET_DSCP_MASK, dev_net(dev), + tunnel->parms.link, tunnel->fwmark, 0, 0); + rt = ip_route_output_key(tunnel->net, &fl4); + +-- +2.39.5 + diff --git a/queue-6.1/ipv4-ip_tunnel-unmask-upper-dscp-bits-in-ip_tunnel_x.patch b/queue-6.1/ipv4-ip_tunnel-unmask-upper-dscp-bits-in-ip_tunnel_x.patch new file mode 100644 index 00000000000..588dc68af54 --- /dev/null +++ b/queue-6.1/ipv4-ip_tunnel-unmask-upper-dscp-bits-in-ip_tunnel_x.patch @@ -0,0 +1,43 @@ +From d4c433e4ebf7ecbb30bb6b2b0bcbb4178cbb07db Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Sep 2024 19:51:35 +0300 +Subject: ipv4: ip_tunnel: Unmask upper DSCP bits in ip_tunnel_xmit() + +From: Ido Schimmel + +[ Upstream commit c2b639f9f3b7a058ca9c7349b096f355773f2cd8 ] + +Unmask the upper DSCP bits when initializing an IPv4 flow key via +ip_tunnel_init_flow() before passing it to ip_route_output_key() so that +in the future we could perform the FIB lookup according to the full DSCP +value. + +Note that the 'tos' variable includes the full DS field. Either the one +specified as part of the tunnel parameters or the one inherited from the +inner packet. + +Signed-off-by: Ido Schimmel +Reviewed-by: Guillaume Nault +Signed-off-by: David S. Miller +Stable-dep-of: b5a7b661a073 ("net: Fix netns for ip_tunnel_init_flow()") +Signed-off-by: Sasha Levin +--- + net/ipv4/ip_tunnel.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c +index eb74e33ffb64..4f30ccf2d321 100644 +--- a/net/ipv4/ip_tunnel.c ++++ b/net/ipv4/ip_tunnel.c +@@ -773,7 +773,7 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev, + } + + ip_tunnel_init_flow(&fl4, protocol, dst, tnl_params->saddr, +- tunnel->parms.o_key, RT_TOS(tos), ++ tunnel->parms.o_key, tos & INET_DSCP_MASK, + dev_net(dev), READ_ONCE(tunnel->parms.link), + tunnel->fwmark, skb_get_hash(skb), 0); + +-- +2.39.5 + diff --git a/queue-6.1/net-dsa-microchip-add-ksz_rmw8-function.patch b/queue-6.1/net-dsa-microchip-add-ksz_rmw8-function.patch new file mode 100644 index 00000000000..94ca605e7e0 --- /dev/null +++ b/queue-6.1/net-dsa-microchip-add-ksz_rmw8-function.patch @@ -0,0 +1,40 @@ +From fff5f6f19bdf3f4fb675fe17acd4115ef33a9d36 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Dec 2022 06:22:29 +0100 +Subject: net: dsa: microchip: add ksz_rmw8() function + +From: Oleksij Rempel + +[ Upstream commit 6f1b986a43ce9aa67b11a7e54ac75530705d04e7 ] + +Add ksz_rmw8(), it will be used in the next patch. + +Signed-off-by: Oleksij Rempel +Acked-by: Arun Ramadoss +Reviewed-by: Florian Fainelli +Signed-off-by: Paolo Abeni +Stable-dep-of: bb9869043438 ("net: dsa: microchip: Fix LAN937X set_ageing_time function") +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/microchip/ksz_common.h | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/net/dsa/microchip/ksz_common.h b/drivers/net/dsa/microchip/ksz_common.h +index d1b2db8e6533..a3a7a90dad96 100644 +--- a/drivers/net/dsa/microchip/ksz_common.h ++++ b/drivers/net/dsa/microchip/ksz_common.h +@@ -454,6 +454,11 @@ static inline int ksz_write64(struct ksz_device *dev, u32 reg, u64 value) + return regmap_bulk_write(dev->regmap[2], reg, val, 2); + } + ++static inline int ksz_rmw8(struct ksz_device *dev, int offset, u8 mask, u8 val) ++{ ++ return regmap_update_bits(dev->regmap[0], offset, mask, val); ++} ++ + static inline int ksz_pread8(struct ksz_device *dev, int port, int offset, + u8 *data) + { +-- +2.39.5 + diff --git a/queue-6.1/net-dsa-microchip-fix-ksz9477-set_ageing_time-functi.patch b/queue-6.1/net-dsa-microchip-fix-ksz9477-set_ageing_time-functi.patch new file mode 100644 index 00000000000..e20cf4f3e1d --- /dev/null +++ b/queue-6.1/net-dsa-microchip-fix-ksz9477-set_ageing_time-functi.patch @@ -0,0 +1,125 @@ +From c8e0bee6b3bc3b02a407e506383842b51714fffc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Dec 2024 18:02:23 -0800 +Subject: net: dsa: microchip: Fix KSZ9477 set_ageing_time function + +From: Tristram Ha + +[ Upstream commit 262bfba8ab820641c8cfbbf03b86d6c00242c078 ] + +The aging count is not a simple 11-bit value but comprises a 3-bit +multiplier and an 8-bit second count. The code tries to use the +original multiplier which is 4 as the second count is still 300 seconds +by default. + +Fixes: 2c119d9982b1 ("net: dsa: microchip: add the support for set_ageing_time") +Signed-off-by: Tristram Ha +Reviewed-by: Andrew Lunn +Link: https://patch.msgid.link/20241218020224.70590-2-Tristram.Ha@microchip.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/microchip/ksz9477.c | 47 +++++++++++++++++++------ + drivers/net/dsa/microchip/ksz9477_reg.h | 4 +-- + 2 files changed, 37 insertions(+), 14 deletions(-) + +diff --git a/drivers/net/dsa/microchip/ksz9477.c b/drivers/net/dsa/microchip/ksz9477.c +index e9fa92a83322..b854ee425fcd 100644 +--- a/drivers/net/dsa/microchip/ksz9477.c ++++ b/drivers/net/dsa/microchip/ksz9477.c +@@ -2,7 +2,7 @@ + /* + * Microchip KSZ9477 switch driver main logic + * +- * Copyright (C) 2017-2019 Microchip Technology Inc. ++ * Copyright (C) 2017-2024 Microchip Technology Inc. + */ + + #include +@@ -964,26 +964,51 @@ void ksz9477_get_caps(struct ksz_device *dev, int port, + int ksz9477_set_ageing_time(struct ksz_device *dev, unsigned int msecs) + { + u32 secs = msecs / 1000; +- u8 value; +- u8 data; ++ u8 data, mult, value; ++ u32 max_val; + int ret; + +- value = FIELD_GET(SW_AGE_PERIOD_7_0_M, secs); ++#define MAX_TIMER_VAL ((1 << 8) - 1) + +- ret = ksz_write8(dev, REG_SW_LUE_CTRL_3, value); +- if (ret < 0) +- return ret; ++ /* The aging timer comprises a 3-bit multiplier and an 8-bit second ++ * value. Either of them cannot be zero. The maximum timer is then ++ * 7 * 255 = 1785 seconds. ++ */ ++ if (!secs) ++ secs = 1; + +- data = FIELD_GET(SW_AGE_PERIOD_10_8_M, secs); ++ /* Return error if too large. */ ++ else if (secs > 7 * MAX_TIMER_VAL) ++ return -EINVAL; + + ret = ksz_read8(dev, REG_SW_LUE_CTRL_0, &value); + if (ret < 0) + return ret; + +- value &= ~SW_AGE_CNT_M; +- value |= FIELD_PREP(SW_AGE_CNT_M, data); ++ /* Check whether there is need to update the multiplier. */ ++ mult = FIELD_GET(SW_AGE_CNT_M, value); ++ max_val = MAX_TIMER_VAL; ++ if (mult > 0) { ++ /* Try to use the same multiplier already in the register as ++ * the hardware default uses multiplier 4 and 75 seconds for ++ * 300 seconds. ++ */ ++ max_val = DIV_ROUND_UP(secs, mult); ++ if (max_val > MAX_TIMER_VAL || max_val * mult != secs) ++ max_val = MAX_TIMER_VAL; ++ } ++ ++ data = DIV_ROUND_UP(secs, max_val); ++ if (mult != data) { ++ value &= ~SW_AGE_CNT_M; ++ value |= FIELD_PREP(SW_AGE_CNT_M, data); ++ ret = ksz_write8(dev, REG_SW_LUE_CTRL_0, value); ++ if (ret < 0) ++ return ret; ++ } + +- return ksz_write8(dev, REG_SW_LUE_CTRL_0, value); ++ value = DIV_ROUND_UP(secs, data); ++ return ksz_write8(dev, REG_SW_LUE_CTRL_3, value); + } + + void ksz9477_port_setup(struct ksz_device *dev, int port, bool cpu_port) +diff --git a/drivers/net/dsa/microchip/ksz9477_reg.h b/drivers/net/dsa/microchip/ksz9477_reg.h +index 04086e9ab0a0..ffb9484018ed 100644 +--- a/drivers/net/dsa/microchip/ksz9477_reg.h ++++ b/drivers/net/dsa/microchip/ksz9477_reg.h +@@ -2,7 +2,7 @@ + /* + * Microchip KSZ9477 register definitions + * +- * Copyright (C) 2017-2018 Microchip Technology Inc. ++ * Copyright (C) 2017-2024 Microchip Technology Inc. + */ + + #ifndef __KSZ9477_REGS_H +@@ -190,8 +190,6 @@ + #define SW_VLAN_ENABLE BIT(7) + #define SW_DROP_INVALID_VID BIT(6) + #define SW_AGE_CNT_M GENMASK(5, 3) +-#define SW_AGE_CNT_S 3 +-#define SW_AGE_PERIOD_10_8_M GENMASK(10, 8) + #define SW_RESV_MCAST_ENABLE BIT(2) + #define SW_HASH_OPTION_M 0x03 + #define SW_HASH_OPTION_CRC 1 +-- +2.39.5 + diff --git a/queue-6.1/net-dsa-microchip-fix-lan937x-set_ageing_time-functi.patch b/queue-6.1/net-dsa-microchip-fix-lan937x-set_ageing_time-functi.patch new file mode 100644 index 00000000000..d955b762e6d --- /dev/null +++ b/queue-6.1/net-dsa-microchip-fix-lan937x-set_ageing_time-functi.patch @@ -0,0 +1,145 @@ +From 0631ccbd5ca96eadbfe41f9309f905aa5749a2f6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Dec 2024 18:02:24 -0800 +Subject: net: dsa: microchip: Fix LAN937X set_ageing_time function + +From: Tristram Ha + +[ Upstream commit bb9869043438af5b94230f94fb4c39206525d758 ] + +The aging count is not a simple 20-bit value but comprises a 3-bit +multiplier and a 20-bit second time. The code tries to use the +original multiplier which is 4 as the second count is still 300 seconds +by default. + +As the 20-bit number is now too large for practical use there is an option +to interpret it as microseconds instead of seconds. + +Fixes: 2c119d9982b1 ("net: dsa: microchip: add the support for set_ageing_time") +Signed-off-by: Tristram Ha +Reviewed-by: Andrew Lunn +Link: https://patch.msgid.link/20241218020224.70590-3-Tristram.Ha@microchip.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/microchip/lan937x_main.c | 62 ++++++++++++++++++++++-- + drivers/net/dsa/microchip/lan937x_reg.h | 9 ++-- + 2 files changed, 65 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/dsa/microchip/lan937x_main.c b/drivers/net/dsa/microchip/lan937x_main.c +index 7e4f307a0387..338eff0818df 100644 +--- a/drivers/net/dsa/microchip/lan937x_main.c ++++ b/drivers/net/dsa/microchip/lan937x_main.c +@@ -1,6 +1,6 @@ + // SPDX-License-Identifier: GPL-2.0 + /* Microchip LAN937X switch driver main logic +- * Copyright (C) 2019-2022 Microchip Technology Inc. ++ * Copyright (C) 2019-2024 Microchip Technology Inc. + */ + #include + #include +@@ -249,10 +249,66 @@ int lan937x_change_mtu(struct ksz_device *dev, int port, int new_mtu) + + int lan937x_set_ageing_time(struct ksz_device *dev, unsigned int msecs) + { +- u32 secs = msecs / 1000; +- u32 value; ++ u8 data, mult, value8; ++ bool in_msec = false; ++ u32 max_val, value; ++ u32 secs = msecs; + int ret; + ++#define MAX_TIMER_VAL ((1 << 20) - 1) ++ ++ /* The aging timer comprises a 3-bit multiplier and a 20-bit second ++ * value. Either of them cannot be zero. The maximum timer is then ++ * 7 * 1048575 = 7340025 seconds. As this value is too large for ++ * practical use it can be interpreted as microseconds, making the ++ * maximum timer 7340 seconds with finer control. This allows for ++ * maximum 122 minutes compared to 29 minutes in KSZ9477 switch. ++ */ ++ if (msecs % 1000) ++ in_msec = true; ++ else ++ secs /= 1000; ++ if (!secs) ++ secs = 1; ++ ++ /* Return error if too large. */ ++ else if (secs > 7 * MAX_TIMER_VAL) ++ return -EINVAL; ++ ++ /* Configure how to interpret the number value. */ ++ ret = ksz_rmw8(dev, REG_SW_LUE_CTRL_2, SW_AGE_CNT_IN_MICROSEC, ++ in_msec ? SW_AGE_CNT_IN_MICROSEC : 0); ++ if (ret < 0) ++ return ret; ++ ++ ret = ksz_read8(dev, REG_SW_LUE_CTRL_0, &value8); ++ if (ret < 0) ++ return ret; ++ ++ /* Check whether there is need to update the multiplier. */ ++ mult = FIELD_GET(SW_AGE_CNT_M, value8); ++ max_val = MAX_TIMER_VAL; ++ if (mult > 0) { ++ /* Try to use the same multiplier already in the register as ++ * the hardware default uses multiplier 4 and 75 seconds for ++ * 300 seconds. ++ */ ++ max_val = DIV_ROUND_UP(secs, mult); ++ if (max_val > MAX_TIMER_VAL || max_val * mult != secs) ++ max_val = MAX_TIMER_VAL; ++ } ++ ++ data = DIV_ROUND_UP(secs, max_val); ++ if (mult != data) { ++ value8 &= ~SW_AGE_CNT_M; ++ value8 |= FIELD_PREP(SW_AGE_CNT_M, data); ++ ret = ksz_write8(dev, REG_SW_LUE_CTRL_0, value8); ++ if (ret < 0) ++ return ret; ++ } ++ ++ secs = DIV_ROUND_UP(secs, data); ++ + value = FIELD_GET(SW_AGE_PERIOD_7_0_M, secs); + + ret = ksz_write8(dev, REG_SW_AGE_PERIOD__1, value); +diff --git a/drivers/net/dsa/microchip/lan937x_reg.h b/drivers/net/dsa/microchip/lan937x_reg.h +index 5bc16a4c4441..f36ef2ce4065 100644 +--- a/drivers/net/dsa/microchip/lan937x_reg.h ++++ b/drivers/net/dsa/microchip/lan937x_reg.h +@@ -1,6 +1,6 @@ + /* SPDX-License-Identifier: GPL-2.0 */ + /* Microchip LAN937X switch register definitions +- * Copyright (C) 2019-2021 Microchip Technology Inc. ++ * Copyright (C) 2019-2024 Microchip Technology Inc. + */ + #ifndef __LAN937X_REG_H + #define __LAN937X_REG_H +@@ -48,8 +48,7 @@ + + #define SW_VLAN_ENABLE BIT(7) + #define SW_DROP_INVALID_VID BIT(6) +-#define SW_AGE_CNT_M 0x7 +-#define SW_AGE_CNT_S 3 ++#define SW_AGE_CNT_M GENMASK(5, 3) + #define SW_RESV_MCAST_ENABLE BIT(2) + + #define REG_SW_LUE_CTRL_1 0x0311 +@@ -62,6 +61,10 @@ + #define SW_FAST_AGING BIT(1) + #define SW_LINK_AUTO_AGING BIT(0) + ++#define REG_SW_LUE_CTRL_2 0x0312 ++ ++#define SW_AGE_CNT_IN_MICROSEC BIT(7) ++ + #define REG_SW_AGE_PERIOD__1 0x0313 + #define SW_AGE_PERIOD_7_0_M GENMASK(7, 0) + +-- +2.39.5 + diff --git a/queue-6.1/net-fix-memory-leak-in-tcp_conn_request.patch b/queue-6.1/net-fix-memory-leak-in-tcp_conn_request.patch new file mode 100644 index 00000000000..ac722429490 --- /dev/null +++ b/queue-6.1/net-fix-memory-leak-in-tcp_conn_request.patch @@ -0,0 +1,64 @@ +From 7f6099dfcde96982b47f31a38de5ad9e2cd51deb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Dec 2024 15:28:59 +0800 +Subject: net: fix memory leak in tcp_conn_request() + +From: Wang Liang + +[ Upstream commit 4f4aa4aa28142d53f8b06585c478476cfe325cfc ] + +If inet_csk_reqsk_queue_hash_add() return false, tcp_conn_request() will +return without free the dst memory, which allocated in af_ops->route_req. + +Here is the kmemleak stack: + +unreferenced object 0xffff8881198631c0 (size 240): + comm "softirq", pid 0, jiffies 4299266571 (age 1802.392s) + hex dump (first 32 bytes): + 00 10 9b 03 81 88 ff ff 80 98 da bc ff ff ff ff ................ + 81 55 18 bb ff ff ff ff 00 00 00 00 00 00 00 00 .U.............. + backtrace: + [] kmem_cache_alloc+0x60c/0xa80 + [] dst_alloc+0x55/0x250 + [] rt_dst_alloc+0x46/0x1d0 + [] __mkroute_output+0x29a/0xa50 + [] ip_route_output_key_hash+0x10b/0x240 + [] ip_route_output_flow+0x1d/0x90 + [] inet_csk_route_req+0x2c5/0x500 + [] tcp_conn_request+0x691/0x12c0 + [] tcp_rcv_state_process+0x3c8/0x11b0 + [] tcp_v4_do_rcv+0x156/0x3b0 + [] tcp_v4_rcv+0x1cf8/0x1d80 + [] ip_protocol_deliver_rcu+0xf6/0x360 + [] ip_local_deliver_finish+0xe6/0x1e0 + [] ip_local_deliver+0xee/0x360 + [] ip_rcv+0xad/0x2f0 + [] __netif_receive_skb_one_core+0x123/0x140 + +Call dst_release() to free the dst memory when +inet_csk_reqsk_queue_hash_add() return false in tcp_conn_request(). + +Fixes: ff46e3b44219 ("Fix race for duplicate reqsk on identical SYN") +Signed-off-by: Wang Liang +Link: https://patch.msgid.link/20241219072859.3783576-1-wangliang74@huawei.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_input.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index 9ac47ccfe120..2379ee551164 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -7124,6 +7124,7 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops, + if (unlikely(!inet_csk_reqsk_queue_hash_add(sk, req, + req->timeout))) { + reqsk_free(req); ++ dst_release(dst); + return 0; + } + +-- +2.39.5 + diff --git a/queue-6.1/net-fix-netns-for-ip_tunnel_init_flow.patch b/queue-6.1/net-fix-netns-for-ip_tunnel_init_flow.patch new file mode 100644 index 00000000000..abd3455aa0d --- /dev/null +++ b/queue-6.1/net-fix-netns-for-ip_tunnel_init_flow.patch @@ -0,0 +1,71 @@ +From 435985b21a158d3e948b7535e2c80aa80690b2e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Dec 2024 21:03:36 +0800 +Subject: net: Fix netns for ip_tunnel_init_flow() + +From: Xiao Liang + +[ Upstream commit b5a7b661a073727219fedc35f5619f62418ffe72 ] + +The device denoted by tunnel->parms.link resides in the underlay net +namespace. Therefore pass tunnel->net to ip_tunnel_init_flow(). + +Fixes: db53cd3d88dc ("net: Handle l3mdev in ip_tunnel_init_flow") +Signed-off-by: Xiao Liang +Reviewed-by: Ido Schimmel +Link: https://patch.msgid.link/20241219130336.103839-1-shaw.leon@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlxsw/spectrum_span.c | 3 +-- + net/ipv4/ip_tunnel.c | 6 +++--- + 2 files changed, 4 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_span.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_span.c +index b3472fb94617..8883ef012747 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_span.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_span.c +@@ -423,8 +423,7 @@ mlxsw_sp_span_gretap4_route(const struct net_device *to_dev, + + parms = mlxsw_sp_ipip_netdev_parms4(to_dev); + ip_tunnel_init_flow(&fl4, parms.iph.protocol, *daddrp, *saddrp, +- 0, 0, dev_net(to_dev), parms.link, tun->fwmark, 0, +- 0); ++ 0, 0, tun->net, parms.link, tun->fwmark, 0, 0); + + rt = ip_route_output_key(tun->net, &fl4); + if (IS_ERR(rt)) +diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c +index 4f30ccf2d321..67cabc40f1dc 100644 +--- a/net/ipv4/ip_tunnel.c ++++ b/net/ipv4/ip_tunnel.c +@@ -294,7 +294,7 @@ static int ip_tunnel_bind_dev(struct net_device *dev) + + ip_tunnel_init_flow(&fl4, iph->protocol, iph->daddr, + iph->saddr, tunnel->parms.o_key, +- iph->tos & INET_DSCP_MASK, dev_net(dev), ++ iph->tos & INET_DSCP_MASK, tunnel->net, + tunnel->parms.link, tunnel->fwmark, 0, 0); + rt = ip_route_output_key(tunnel->net, &fl4); + +@@ -611,7 +611,7 @@ void ip_md_tunnel_xmit(struct sk_buff *skb, struct net_device *dev, + } + ip_tunnel_init_flow(&fl4, proto, key->u.ipv4.dst, key->u.ipv4.src, + tunnel_id_to_key32(key->tun_id), +- tos & INET_DSCP_MASK, dev_net(dev), 0, skb->mark, ++ tos & INET_DSCP_MASK, tunnel->net, 0, skb->mark, + skb_get_hash(skb), key->flow_flags); + + if (!tunnel_hlen) +@@ -774,7 +774,7 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev, + + ip_tunnel_init_flow(&fl4, protocol, dst, tnl_params->saddr, + tunnel->parms.o_key, tos & INET_DSCP_MASK, +- dev_net(dev), READ_ONCE(tunnel->parms.link), ++ tunnel->net, READ_ONCE(tunnel->parms.link), + tunnel->fwmark, skb_get_hash(skb), 0); + + if (ip_tunnel_encap(skb, &tunnel->encap, &protocol, &fl4) < 0) +-- +2.39.5 + diff --git a/queue-6.1/net-llc-reset-skb-transport_header.patch b/queue-6.1/net-llc-reset-skb-transport_header.patch new file mode 100644 index 00000000000..c58cdaaf471 --- /dev/null +++ b/queue-6.1/net-llc-reset-skb-transport_header.patch @@ -0,0 +1,62 @@ +From 8fb53a7c93be4a460f02487a80350f8f8970fc96 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Dec 2024 20:07:20 -0500 +Subject: net: llc: reset skb->transport_header + +From: Antonio Pastor + +[ Upstream commit a024e377efed31ecfb39210bed562932321345b3 ] + +802.2+LLC+SNAP frames received by napi_complete_done with GRO and DSA +have skb->transport_header set two bytes short, or pointing 2 bytes +before network_header & skb->data. As snap_rcv expects transport_header +to point to SNAP header (OID:PID) after LLC processing advances offset +over LLC header (llc_rcv & llc_fixup_skb), code doesn't find a match +and packet is dropped. + +Between napi_complete_done and snap_rcv, transport_header is not used +until __netif_receive_skb_core, where originally it was being reset. +Commit fda55eca5a33 ("net: introduce skb_transport_header_was_set()") +only does so if not set, on the assumption the value was set correctly +by GRO (and also on assumption that "network stacks usually reset the +transport header anyway"). Afterwards it is moved forward by +llc_fixup_skb. + +Locally generated traffic shows up at __netif_receive_skb_core with no +transport_header set and is processed without issue. On a setup with +GRO but no DSA, transport_header and network_header are both set to +point to skb->data which is also correct. + +As issue is LLC specific, to avoid impacting non-LLC traffic, and to +follow up on original assumption made on previous code change, +llc_fixup_skb to reset the offset after skb pull. llc_fixup_skb +assumes the LLC header is at skb->data, and by definition SNAP header +immediately follows. + +Fixes: fda55eca5a33 ("net: introduce skb_transport_header_was_set()") +Signed-off-by: Antonio Pastor +Reviewed-by: Eric Dumazet +Link: https://patch.msgid.link/20241225010723.2830290-1-antonio.pastor@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/llc/llc_input.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/llc/llc_input.c b/net/llc/llc_input.c +index 51bccfb00a9c..61b0159b2fbe 100644 +--- a/net/llc/llc_input.c ++++ b/net/llc/llc_input.c +@@ -124,8 +124,8 @@ static inline int llc_fixup_skb(struct sk_buff *skb) + if (unlikely(!pskb_may_pull(skb, llc_len))) + return 0; + +- skb->transport_header += llc_len; + skb_pull(skb, llc_len); ++ skb_reset_transport_header(skb); + if (skb->protocol == htons(ETH_P_802_2)) { + __be16 pdulen; + s32 data_size; +-- +2.39.5 + diff --git a/queue-6.1/net-mv643xx_eth-fix-an-of-node-reference-leak.patch b/queue-6.1/net-mv643xx_eth-fix-an-of-node-reference-leak.patch new file mode 100644 index 00000000000..3464cffe927 --- /dev/null +++ b/queue-6.1/net-mv643xx_eth-fix-an-of-node-reference-leak.patch @@ -0,0 +1,70 @@ +From c540a927cc924596583b98af7112f6152d5d3fe5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 21 Dec 2024 17:14:48 +0900 +Subject: net: mv643xx_eth: fix an OF node reference leak + +From: Joe Hattori + +[ Upstream commit ad5c318086e2e23b577eca33559c5ebf89bc7eb9 ] + +Current implementation of mv643xx_eth_shared_of_add_port() calls +of_parse_phandle(), but does not release the refcount on error. Call +of_node_put() in the error path and in mv643xx_eth_shared_of_remove(). + +This bug was found by an experimental verification tool that I am +developing. + +Fixes: 76723bca2802 ("net: mv643xx_eth: add DT parsing support") +Signed-off-by: Joe Hattori +Link: https://patch.msgid.link/20241221081448.3313163-1-joe@pf.is.s.u-tokyo.ac.jp +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/mv643xx_eth.c | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/mv643xx_eth.c b/drivers/net/ethernet/marvell/mv643xx_eth.c +index 8941f69d93e9..b9dda48326d5 100644 +--- a/drivers/net/ethernet/marvell/mv643xx_eth.c ++++ b/drivers/net/ethernet/marvell/mv643xx_eth.c +@@ -2707,9 +2707,15 @@ static struct platform_device *port_platdev[3]; + + static void mv643xx_eth_shared_of_remove(void) + { ++ struct mv643xx_eth_platform_data *pd; + int n; + + for (n = 0; n < 3; n++) { ++ if (!port_platdev[n]) ++ continue; ++ pd = dev_get_platdata(&port_platdev[n]->dev); ++ if (pd) ++ of_node_put(pd->phy_node); + platform_device_del(port_platdev[n]); + port_platdev[n] = NULL; + } +@@ -2770,8 +2776,10 @@ static int mv643xx_eth_shared_of_add_port(struct platform_device *pdev, + } + + ppdev = platform_device_alloc(MV643XX_ETH_NAME, dev_num); +- if (!ppdev) +- return -ENOMEM; ++ if (!ppdev) { ++ ret = -ENOMEM; ++ goto put_err; ++ } + ppdev->dev.coherent_dma_mask = DMA_BIT_MASK(32); + ppdev->dev.of_node = pnp; + +@@ -2793,6 +2801,8 @@ static int mv643xx_eth_shared_of_add_port(struct platform_device *pdev, + + port_err: + platform_device_put(ppdev); ++put_err: ++ of_node_put(ppd.phy_node); + return ret; + } + +-- +2.39.5 + diff --git a/queue-6.1/net-reenable-netif_f_ipv6_csum-offload-for-big-tcp-p.patch b/queue-6.1/net-reenable-netif_f_ipv6_csum-offload-for-big-tcp-p.patch new file mode 100644 index 00000000000..a4cfc0c6c6e --- /dev/null +++ b/queue-6.1/net-reenable-netif_f_ipv6_csum-offload-for-big-tcp-p.patch @@ -0,0 +1,83 @@ +From 9eb46021dae8dea66f4afa490ef3087f2e65f1e4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Jan 2025 11:47:40 -0500 +Subject: net: reenable NETIF_F_IPV6_CSUM offload for BIG TCP packets + +From: Willem de Bruijn + +[ Upstream commit 68e068cabd2c6c533ef934c2e5151609cf6ecc6d ] + +The blamed commit disabled hardware offoad of IPv6 packets with +extension headers on devices that advertise NETIF_F_IPV6_CSUM, +based on the definition of that feature in skbuff.h: + + * * - %NETIF_F_IPV6_CSUM + * - Driver (device) is only able to checksum plain + * TCP or UDP packets over IPv6. These are specifically + * unencapsulated packets of the form IPv6|TCP or + * IPv6|UDP where the Next Header field in the IPv6 + * header is either TCP or UDP. IPv6 extension headers + * are not supported with this feature. This feature + * cannot be set in features for a device with + * NETIF_F_HW_CSUM also set. This feature is being + * DEPRECATED (see below). + +The change causes skb_warn_bad_offload to fire for BIG TCP +packets. + +[ 496.310233] WARNING: CPU: 13 PID: 23472 at net/core/dev.c:3129 skb_warn_bad_offload+0xc4/0xe0 + +[ 496.310297] ? skb_warn_bad_offload+0xc4/0xe0 +[ 496.310300] skb_checksum_help+0x129/0x1f0 +[ 496.310303] skb_csum_hwoffload_help+0x150/0x1b0 +[ 496.310306] validate_xmit_skb+0x159/0x270 +[ 496.310309] validate_xmit_skb_list+0x41/0x70 +[ 496.310312] sch_direct_xmit+0x5c/0x250 +[ 496.310317] __qdisc_run+0x388/0x620 + +BIG TCP introduced an IPV6_TLV_JUMBO IPv6 extension header to +communicate packet length, as this is an IPv6 jumbogram. But, the +feature is only enabled on devices that support BIG TCP TSO. The +header is only present for PF_PACKET taps like tcpdump, and not +transmitted by physical devices. + +For this specific case of extension headers that are not +transmitted, return to the situation before the blamed commit +and support hardware offload. + +ipv6_has_hopopt_jumbo() tests not only whether this header is present, +but also that it is the only extension header before a terminal (L4) +header. + +Fixes: 04c20a9356f2 ("net: skip offload for NETIF_F_IPV6_CSUM if ipv6 header contains extension") +Reported-by: syzbot +Reported-by: Eric Dumazet +Closes: https://lore.kernel.org/netdev/CANn89iK1hdC3Nt8KPhOtTF8vCPc1AHDCtse_BTNki1pWxAByTQ@mail.gmail.com/ +Signed-off-by: Willem de Bruijn +Reviewed-by: Eric Dumazet +Link: https://patch.msgid.link/20250101164909.1331680-1-willemdebruijn.kernel@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/core/dev.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/net/core/dev.c b/net/core/dev.c +index 2ee1a535b3cb..90559cb66803 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -3679,8 +3679,10 @@ int skb_csum_hwoffload_help(struct sk_buff *skb, + + if (features & (NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM)) { + if (vlan_get_protocol(skb) == htons(ETH_P_IPV6) && +- skb_network_header_len(skb) != sizeof(struct ipv6hdr)) ++ skb_network_header_len(skb) != sizeof(struct ipv6hdr) && ++ !ipv6_has_hopopt_jumbo(skb)) + goto sw_checksum; ++ + switch (skb->csum_offset) { + case offsetof(struct tcphdr, check): + case offsetof(struct udphdr, check): +-- +2.39.5 + diff --git a/queue-6.1/net-restrict-so_reuseport-to-inet-sockets.patch b/queue-6.1/net-restrict-so_reuseport-to-inet-sockets.patch new file mode 100644 index 00000000000..af31587dfec --- /dev/null +++ b/queue-6.1/net-restrict-so_reuseport-to-inet-sockets.patch @@ -0,0 +1,87 @@ +From 61c217bf60a4dfd681811e7f16419428ac10995d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 Dec 2024 16:05:27 +0000 +Subject: net: restrict SO_REUSEPORT to inet sockets + +From: Eric Dumazet + +[ Upstream commit 5b0af621c3f6ef9261cf6067812f2fd9943acb4b ] + +After blamed commit, crypto sockets could accidentally be destroyed +from RCU call back, as spotted by zyzbot [1]. + +Trying to acquire a mutex in RCU callback is not allowed. + +Restrict SO_REUSEPORT socket option to inet sockets. + +v1 of this patch supported TCP, UDP and SCTP sockets, +but fcnal-test.sh test needed RAW and ICMP support. + +[1] +BUG: sleeping function called from invalid context at kernel/locking/mutex.c:562 +in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 24, name: ksoftirqd/1 +preempt_count: 100, expected: 0 +RCU nest depth: 0, expected: 0 +1 lock held by ksoftirqd/1/24: + #0: ffffffff8e937ba0 (rcu_callback){....}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline] + #0: ffffffff8e937ba0 (rcu_callback){....}-{0:0}, at: rcu_do_batch kernel/rcu/tree.c:2561 [inline] + #0: ffffffff8e937ba0 (rcu_callback){....}-{0:0}, at: rcu_core+0xa37/0x17a0 kernel/rcu/tree.c:2823 +Preemption disabled at: + [] softirq_handle_begin kernel/softirq.c:402 [inline] + [] handle_softirqs+0x128/0x9b0 kernel/softirq.c:537 +CPU: 1 UID: 0 PID: 24 Comm: ksoftirqd/1 Not tainted 6.13.0-rc3-syzkaller-00174-ga024e377efed #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 +Call Trace: + + __dump_stack lib/dump_stack.c:94 [inline] + dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 + __might_resched+0x5d4/0x780 kernel/sched/core.c:8758 + __mutex_lock_common kernel/locking/mutex.c:562 [inline] + __mutex_lock+0x131/0xee0 kernel/locking/mutex.c:735 + crypto_put_default_null_skcipher+0x18/0x70 crypto/crypto_null.c:179 + aead_release+0x3d/0x50 crypto/algif_aead.c:489 + alg_do_release crypto/af_alg.c:118 [inline] + alg_sock_destruct+0x86/0xc0 crypto/af_alg.c:502 + __sk_destruct+0x58/0x5f0 net/core/sock.c:2260 + rcu_do_batch kernel/rcu/tree.c:2567 [inline] + rcu_core+0xaaa/0x17a0 kernel/rcu/tree.c:2823 + handle_softirqs+0x2d4/0x9b0 kernel/softirq.c:561 + run_ksoftirqd+0xca/0x130 kernel/softirq.c:950 + smpboot_thread_fn+0x544/0xa30 kernel/smpboot.c:164 + kthread+0x2f0/0x390 kernel/kthread.c:389 + ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 + ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 + + +Fixes: 8c7138b33e5c ("net: Unpublish sk from sk_reuseport_cb before call_rcu") +Reported-by: syzbot+b3e02953598f447d4d2a@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/netdev/6772f2f4.050a0220.2f3838.04cb.GAE@google.com/T/#u +Signed-off-by: Eric Dumazet +Cc: Martin KaFai Lau +Reviewed-by: Kuniyuki Iwashima +Link: https://patch.msgid.link/20241231160527.3994168-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/core/sock.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/net/core/sock.c b/net/core/sock.c +index dce8f878f638..168e7f42c054 100644 +--- a/net/core/sock.c ++++ b/net/core/sock.c +@@ -1122,7 +1122,10 @@ int sk_setsockopt(struct sock *sk, int level, int optname, + sk->sk_reuse = (valbool ? SK_CAN_REUSE : SK_NO_REUSE); + break; + case SO_REUSEPORT: +- sk->sk_reuseport = valbool; ++ if (valbool && !sk_is_inet(sk)) ++ ret = -EOPNOTSUPP; ++ else ++ sk->sk_reuseport = valbool; + break; + case SO_TYPE: + case SO_PROTOCOL: +-- +2.39.5 + diff --git a/queue-6.1/net-stmmac-don-t-create-a-mdio-bus-if-unnecessary.patch b/queue-6.1/net-stmmac-don-t-create-a-mdio-bus-if-unnecessary.patch new file mode 100644 index 00000000000..13a15fe796a --- /dev/null +++ b/queue-6.1/net-stmmac-don-t-create-a-mdio-bus-if-unnecessary.patch @@ -0,0 +1,248 @@ +From c13a73471e04945579375c3ef8b57645bea4d909 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Dec 2023 16:07:36 -0600 +Subject: net: stmmac: don't create a MDIO bus if unnecessary + +From: Andrew Halaney + +[ Upstream commit f3c2caacee824ce4a331cdafb0b8dc8e987f105e ] + +Currently a MDIO bus is created if the devicetree description is either: + + 1. Not fixed-link + 2. fixed-link but contains a MDIO bus as well + +The "1" case above isn't always accurate. If there's a phy-handle, +it could be referencing a phy on another MDIO controller's bus[1]. In +this case, where the MDIO bus is not described at all, currently +stmmac will make a MDIO bus and scan its address space to discover +phys (of which there are none). This process takes time scanning a bus +that is known to be empty, delaying time to complete probe. + +There are also a lot of upstream devicetrees[2] that expect a MDIO bus +to be created, scanned for phys, and the first one found connected +to the MAC. This case can be inferred from the platform description by +not having a phy-handle && not being fixed-link. This hits case "1" in +the current driver's logic, and must be handled in any logic change here +since it is a valid legacy dt-binding. + +Let's improve the logic to create a MDIO bus if either: + + - Devicetree contains a MDIO bus + - !fixed-link && !phy-handle (legacy handling) + +This way the case where no MDIO bus should be made is handled, as well +as retaining backwards compatibility with the valid cases. + +Below devicetree snippets can be found that explain some of +the cases above more concretely. + +Here's[0] a devicetree example where the MAC is both fixed-link and +driving a switch on MDIO (case "2" above). This needs a MDIO bus to +be created: + + &fec1 { + phy-mode = "rmii"; + + fixed-link { + speed = <100>; + full-duplex; + }; + + mdio1: mdio { + switch0: switch0@0 { + compatible = "marvell,mv88e6190"; + pinctrl-0 = <&pinctrl_gpio_switch0>; + }; + }; + }; + +Here's[1] an example where there is no MDIO bus or fixed-link for +the ethernet1 MAC, so no MDIO bus should be created since ethernet0 +is the MDIO master for ethernet1's phy: + + ðernet0 { + phy-mode = "sgmii"; + phy-handle = <&sgmii_phy0>; + + mdio { + compatible = "snps,dwmac-mdio"; + sgmii_phy0: phy@8 { + compatible = "ethernet-phy-id0141.0dd4"; + reg = <0x8>; + device_type = "ethernet-phy"; + }; + + sgmii_phy1: phy@a { + compatible = "ethernet-phy-id0141.0dd4"; + reg = <0xa>; + device_type = "ethernet-phy"; + }; + }; + }; + + ðernet1 { + phy-mode = "sgmii"; + phy-handle = <&sgmii_phy1>; + }; + +Finally there's descriptions like this[2] which don't describe the +MDIO bus but expect it to be created and the whole address space +scanned for a phy since there's no phy-handle or fixed-link described: + + &gmac { + phy-supply = <&vcc_lan>; + phy-mode = "rmii"; + snps,reset-gpio = <&gpio3 RK_PB4 GPIO_ACTIVE_HIGH>; + snps,reset-active-low; + snps,reset-delays-us = <0 10000 1000000>; + }; + +[0] https://elixir.bootlin.com/linux/v6.5-rc5/source/arch/arm/boot/dts/nxp/vf/vf610-zii-ssmb-dtu.dts +[1] https://elixir.bootlin.com/linux/v6.6-rc5/source/arch/arm64/boot/dts/qcom/sa8775p-ride.dts +[2] https://elixir.bootlin.com/linux/v6.6-rc5/source/arch/arm64/boot/dts/rockchip/rk3368-r88.dts#L164 + +Reviewed-by: Serge Semin +Co-developed-by: Bartosz Golaszewski +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Andrew Halaney +Signed-off-by: David S. Miller +Stable-dep-of: 2b6ffcd7873b ("net: stmmac: restructure the error path of stmmac_probe_config_dt()") +Signed-off-by: Sasha Levin +--- + .../ethernet/stmicro/stmmac/stmmac_platform.c | 91 +++++++++++-------- + 1 file changed, 54 insertions(+), 37 deletions(-) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c +index 5b4517b0ca08..e7e7d388399d 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c +@@ -294,62 +294,80 @@ static int stmmac_mtl_setup(struct platform_device *pdev, + } + + /** +- * stmmac_dt_phy - parse device-tree driver parameters to allocate PHY resources +- * @plat: driver data platform structure +- * @np: device tree node +- * @dev: device pointer +- * Description: +- * The mdio bus will be allocated in case of a phy transceiver is on board; +- * it will be NULL if the fixed-link is configured. +- * If there is the "snps,dwmac-mdio" sub-node the mdio will be allocated +- * in any case (for DSA, mdio must be registered even if fixed-link). +- * The table below sums the supported configurations: +- * ------------------------------- +- * snps,phy-addr | Y +- * ------------------------------- +- * phy-handle | Y +- * ------------------------------- +- * fixed-link | N +- * ------------------------------- +- * snps,dwmac-mdio | +- * even if | Y +- * fixed-link | +- * ------------------------------- ++ * stmmac_of_get_mdio() - Gets the MDIO bus from the devicetree. ++ * @np: devicetree node + * +- * It returns 0 in case of success otherwise -ENODEV. ++ * The MDIO bus will be searched for in the following ways: ++ * 1. The compatible is "snps,dwc-qos-ethernet-4.10" && a "mdio" named ++ * child node exists ++ * 2. A child node with the "snps,dwmac-mdio" compatible is present ++ * ++ * Return: The MDIO node if present otherwise NULL + */ +-static int stmmac_dt_phy(struct plat_stmmacenet_data *plat, +- struct device_node *np, struct device *dev) ++static struct device_node *stmmac_of_get_mdio(struct device_node *np) + { +- bool mdio = !of_phy_is_fixed_link(np); + static const struct of_device_id need_mdio_ids[] = { + { .compatible = "snps,dwc-qos-ethernet-4.10" }, + {}, + }; ++ struct device_node *mdio_node = NULL; + + if (of_match_node(need_mdio_ids, np)) { +- plat->mdio_node = of_get_child_by_name(np, "mdio"); ++ mdio_node = of_get_child_by_name(np, "mdio"); + } else { + /** + * If snps,dwmac-mdio is passed from DT, always register + * the MDIO + */ +- for_each_child_of_node(np, plat->mdio_node) { +- if (of_device_is_compatible(plat->mdio_node, ++ for_each_child_of_node(np, mdio_node) { ++ if (of_device_is_compatible(mdio_node, + "snps,dwmac-mdio")) + break; + } + } + +- if (plat->mdio_node) { ++ return mdio_node; ++} ++ ++/** ++ * stmmac_mdio_setup() - Populate platform related MDIO structures. ++ * @plat: driver data platform structure ++ * @np: devicetree node ++ * @dev: device pointer ++ * ++ * This searches for MDIO information from the devicetree. ++ * If an MDIO node is found, it's assigned to plat->mdio_node and ++ * plat->mdio_bus_data is allocated. ++ * If no connection can be determined, just plat->mdio_bus_data is allocated ++ * to indicate a bus should be created and scanned for a phy. ++ * If it's determined there's no MDIO bus needed, both are left NULL. ++ * ++ * This expects that plat->phy_node has already been searched for. ++ * ++ * Return: 0 on success, errno otherwise. ++ */ ++static int stmmac_mdio_setup(struct plat_stmmacenet_data *plat, ++ struct device_node *np, struct device *dev) ++{ ++ bool legacy_mdio; ++ ++ plat->mdio_node = stmmac_of_get_mdio(np); ++ if (plat->mdio_node) + dev_dbg(dev, "Found MDIO subnode\n"); +- mdio = true; +- } + +- if (mdio) { +- plat->mdio_bus_data = +- devm_kzalloc(dev, sizeof(struct stmmac_mdio_bus_data), +- GFP_KERNEL); ++ /* Legacy devicetrees allowed for no MDIO bus description and expect ++ * the bus to be scanned for devices. If there's no phy or fixed-link ++ * described assume this is the case since there must be something ++ * connected to the MAC. ++ */ ++ legacy_mdio = !of_phy_is_fixed_link(np) && !plat->phy_node; ++ if (legacy_mdio) ++ dev_info(dev, "Deprecated MDIO bus assumption used\n"); ++ ++ if (plat->mdio_node || legacy_mdio) { ++ plat->mdio_bus_data = devm_kzalloc(dev, ++ sizeof(*plat->mdio_bus_data), ++ GFP_KERNEL); + if (!plat->mdio_bus_data) + return -ENOMEM; + +@@ -454,8 +472,7 @@ stmmac_probe_config_dt(struct platform_device *pdev, u8 *mac) + if (of_property_read_u32(np, "snps,phy-addr", &plat->phy_addr) == 0) + dev_warn(&pdev->dev, "snps,phy-addr property is deprecated\n"); + +- /* To Configure PHY by using all device-tree supported properties */ +- rc = stmmac_dt_phy(plat, np, &pdev->dev); ++ rc = stmmac_mdio_setup(plat, np, &pdev->dev); + if (rc) + return ERR_PTR(rc); + +-- +2.39.5 + diff --git a/queue-6.1/net-stmmac-platform-provide-devm_stmmac_probe_config.patch b/queue-6.1/net-stmmac-platform-provide-devm_stmmac_probe_config.patch new file mode 100644 index 00000000000..4e71fafb1a8 --- /dev/null +++ b/queue-6.1/net-stmmac-platform-provide-devm_stmmac_probe_config.patch @@ -0,0 +1,110 @@ +From ce5dd34b17b06b2264bb3f2f0e4384a31f5664cb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jun 2023 12:04:14 +0200 +Subject: net: stmmac: platform: provide devm_stmmac_probe_config_dt() + +From: Bartosz Golaszewski + +[ Upstream commit d74065427374da6659a2d7fad4ec55c8926d43c4 ] + +Provide a devres variant of stmmac_probe_config_dt() that allows users to +skip calling stmmac_remove_config_dt() at driver detach. + +Signed-off-by: Bartosz Golaszewski +Link: https://lore.kernel.org/r/20230623100417.93592-9-brgl@bgdev.pl +Signed-off-by: Jakub Kicinski +Stable-dep-of: 2b6ffcd7873b ("net: stmmac: restructure the error path of stmmac_probe_config_dt()") +Signed-off-by: Sasha Levin +--- + .../ethernet/stmicro/stmmac/stmmac_platform.c | 41 +++++++++++++++++++ + .../ethernet/stmicro/stmmac/stmmac_platform.h | 2 + + 2 files changed, 43 insertions(+) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c +index 0046a4ee6e64..5b4517b0ca08 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c +@@ -8,6 +8,7 @@ + Author: Giuseppe Cavallaro + *******************************************************************************/ + ++#include + #include + #include + #include +@@ -628,6 +629,39 @@ stmmac_probe_config_dt(struct platform_device *pdev, u8 *mac) + return ret; + } + ++static void devm_stmmac_remove_config_dt(void *data) ++{ ++ struct plat_stmmacenet_data *plat = data; ++ ++ /* Platform data argument is unused */ ++ stmmac_remove_config_dt(NULL, plat); ++} ++ ++/** ++ * devm_stmmac_probe_config_dt ++ * @pdev: platform_device structure ++ * @mac: MAC address to use ++ * Description: Devres variant of stmmac_probe_config_dt(). Does not require ++ * the user to call stmmac_remove_config_dt() at driver detach. ++ */ ++struct plat_stmmacenet_data * ++devm_stmmac_probe_config_dt(struct platform_device *pdev, u8 *mac) ++{ ++ struct plat_stmmacenet_data *plat; ++ int ret; ++ ++ plat = stmmac_probe_config_dt(pdev, mac); ++ if (IS_ERR(plat)) ++ return plat; ++ ++ ret = devm_add_action_or_reset(&pdev->dev, ++ devm_stmmac_remove_config_dt, plat); ++ if (ret) ++ return ERR_PTR(ret); ++ ++ return plat; ++} ++ + /** + * stmmac_remove_config_dt - undo the effects of stmmac_probe_config_dt() + * @pdev: platform_device structure +@@ -650,12 +684,19 @@ stmmac_probe_config_dt(struct platform_device *pdev, u8 *mac) + return ERR_PTR(-EINVAL); + } + ++struct plat_stmmacenet_data * ++devm_stmmac_probe_config_dt(struct platform_device *pdev, u8 *mac) ++{ ++ return ERR_PTR(-EINVAL); ++} ++ + void stmmac_remove_config_dt(struct platform_device *pdev, + struct plat_stmmacenet_data *plat) + { + } + #endif /* CONFIG_OF */ + EXPORT_SYMBOL_GPL(stmmac_probe_config_dt); ++EXPORT_SYMBOL_GPL(devm_stmmac_probe_config_dt); + EXPORT_SYMBOL_GPL(stmmac_remove_config_dt); + + int stmmac_get_platform_resources(struct platform_device *pdev, +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.h b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.h +index 3fff3f59d73d..2102c6d41464 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.h ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.h +@@ -13,6 +13,8 @@ + + struct plat_stmmacenet_data * + stmmac_probe_config_dt(struct platform_device *pdev, u8 *mac); ++struct plat_stmmacenet_data * ++devm_stmmac_probe_config_dt(struct platform_device *pdev, u8 *mac); + void stmmac_remove_config_dt(struct platform_device *pdev, + struct plat_stmmacenet_data *plat); + +-- +2.39.5 + diff --git a/queue-6.1/net-stmmac-restructure-the-error-path-of-stmmac_prob.patch b/queue-6.1/net-stmmac-restructure-the-error-path-of-stmmac_prob.patch new file mode 100644 index 00000000000..83598185d33 --- /dev/null +++ b/queue-6.1/net-stmmac-restructure-the-error-path-of-stmmac_prob.patch @@ -0,0 +1,105 @@ +From 12e99e161e04fc14743eb336ae86ba3c991b4e6d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Dec 2024 11:41:19 +0900 +Subject: net: stmmac: restructure the error path of stmmac_probe_config_dt() + +From: Joe Hattori + +[ Upstream commit 2b6ffcd7873b7e8a62c3e15a6f305bfc747c466b ] + +Current implementation of stmmac_probe_config_dt() does not release the +OF node reference obtained by of_parse_phandle() in some error paths. +The problem is that some error paths call stmmac_remove_config_dt() to +clean up but others use and unwind ladder. These two types of error +handling have not kept in sync and have been a recurring source of bugs. +Re-write the error handling in stmmac_probe_config_dt() to use an unwind +ladder. Consequently, stmmac_remove_config_dt() is not needed anymore, +thus remove it. + +This bug was found by an experimental verification tool that I am +developing. + +Fixes: 4838a5405028 ("net: stmmac: Fix wrapper drivers not detecting PHY") +Signed-off-by: Joe Hattori +Link: https://patch.msgid.link/20241219024119.2017012-1-joe@pf.is.s.u-tokyo.ac.jp +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + .../ethernet/stmicro/stmmac/stmmac_platform.c | 27 ++++++++++++------- + 1 file changed, 17 insertions(+), 10 deletions(-) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c +index e7e7d388399d..c368ef3cd9cb 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c +@@ -473,8 +473,10 @@ stmmac_probe_config_dt(struct platform_device *pdev, u8 *mac) + dev_warn(&pdev->dev, "snps,phy-addr property is deprecated\n"); + + rc = stmmac_mdio_setup(plat, np, &pdev->dev); +- if (rc) +- return ERR_PTR(rc); ++ if (rc) { ++ ret = ERR_PTR(rc); ++ goto error_put_phy; ++ } + + of_property_read_u32(np, "tx-fifo-depth", &plat->tx_fifo_size); + +@@ -560,8 +562,8 @@ stmmac_probe_config_dt(struct platform_device *pdev, u8 *mac) + dma_cfg = devm_kzalloc(&pdev->dev, sizeof(*dma_cfg), + GFP_KERNEL); + if (!dma_cfg) { +- stmmac_remove_config_dt(pdev, plat); +- return ERR_PTR(-ENOMEM); ++ ret = ERR_PTR(-ENOMEM); ++ goto error_put_mdio; + } + plat->dma_cfg = dma_cfg; + +@@ -589,8 +591,8 @@ stmmac_probe_config_dt(struct platform_device *pdev, u8 *mac) + + rc = stmmac_mtl_setup(pdev, plat); + if (rc) { +- stmmac_remove_config_dt(pdev, plat); +- return ERR_PTR(rc); ++ ret = ERR_PTR(rc); ++ goto error_put_mdio; + } + + /* clock setup */ +@@ -642,6 +644,10 @@ stmmac_probe_config_dt(struct platform_device *pdev, u8 *mac) + clk_disable_unprepare(plat->pclk); + error_pclk_get: + clk_disable_unprepare(plat->stmmac_clk); ++error_put_mdio: ++ of_node_put(plat->mdio_node); ++error_put_phy: ++ of_node_put(plat->phy_node); + + return ret; + } +@@ -650,16 +656,17 @@ static void devm_stmmac_remove_config_dt(void *data) + { + struct plat_stmmacenet_data *plat = data; + +- /* Platform data argument is unused */ +- stmmac_remove_config_dt(NULL, plat); ++ clk_disable_unprepare(plat->stmmac_clk); ++ clk_disable_unprepare(plat->pclk); ++ of_node_put(plat->mdio_node); ++ of_node_put(plat->phy_node); + } + + /** + * devm_stmmac_probe_config_dt + * @pdev: platform_device structure + * @mac: MAC address to use +- * Description: Devres variant of stmmac_probe_config_dt(). Does not require +- * the user to call stmmac_remove_config_dt() at driver detach. ++ * Description: Devres variant of stmmac_probe_config_dt(). + */ + struct plat_stmmacenet_data * + devm_stmmac_probe_config_dt(struct platform_device *pdev, u8 *mac) +-- +2.39.5 + diff --git a/queue-6.1/net-wwan-iosm-properly-check-for-valid-exec-stage-in.patch b/queue-6.1/net-wwan-iosm-properly-check-for-valid-exec-stage-in.patch new file mode 100644 index 00000000000..ae3931d9ecb --- /dev/null +++ b/queue-6.1/net-wwan-iosm-properly-check-for-valid-exec-stage-in.patch @@ -0,0 +1,47 @@ +From 2070117d5b71311f1e5051dce3ebafa8525725c4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 29 Dec 2024 17:46:58 +0100 +Subject: net: wwan: iosm: Properly check for valid exec stage in + ipc_mmio_init() + +From: Maciej S. Szmigiero + +[ Upstream commit a7af435df0e04cfb4a4004136d597c42639a2ae7 ] + +ipc_mmio_init() used the post-decrement operator in its loop continuing +condition of "retries" counter being "> 0", which meant that when this +condition caused loop exit "retries" counter reached -1. + +But the later valid exec stage failure check only tests for "retries" +counter being exactly zero, so it didn't trigger in this case (but +would wrongly trigger if the code reaches a valid exec stage in the +very last loop iteration). + +Fix this by using the pre-decrement operator instead, so the loop counter +is exactly zero on valid exec stage failure. + +Fixes: dc0514f5d828 ("net: iosm: mmio scratchpad") +Signed-off-by: Maciej S. Szmigiero +Link: https://patch.msgid.link/8b19125a825f9dcdd81c667c1e5c48ba28d505a6.1735490770.git.mail@maciej.szmigiero.name +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/wwan/iosm/iosm_ipc_mmio.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wwan/iosm/iosm_ipc_mmio.c b/drivers/net/wwan/iosm/iosm_ipc_mmio.c +index 63eb08c43c05..6764c13530b9 100644 +--- a/drivers/net/wwan/iosm/iosm_ipc_mmio.c ++++ b/drivers/net/wwan/iosm/iosm_ipc_mmio.c +@@ -104,7 +104,7 @@ struct iosm_mmio *ipc_mmio_init(void __iomem *mmio, struct device *dev) + break; + + msleep(20); +- } while (retries-- > 0); ++ } while (--retries > 0); + + if (!retries) { + dev_err(ipc_mmio->dev, "invalid exec stage %X", stage); +-- +2.39.5 + diff --git a/queue-6.1/net-wwan-t7xx-fix-fsm-command-timeout-issue.patch b/queue-6.1/net-wwan-t7xx-fix-fsm-command-timeout-issue.patch new file mode 100644 index 00000000000..543d4378025 --- /dev/null +++ b/queue-6.1/net-wwan-t7xx-fix-fsm-command-timeout-issue.patch @@ -0,0 +1,141 @@ +From 64e6690be83d37572edad0496196b20df99bfad7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Dec 2024 12:15:52 +0800 +Subject: net: wwan: t7xx: Fix FSM command timeout issue + +From: Jinjian Song + +[ Upstream commit 4f619d518db9cd1a933c3a095a5f95d0c1584ae8 ] + +When driver processes the internal state change command, it use an +asynchronous thread to process the command operation. If the main +thread detects that the task has timed out, the asynchronous thread +will panic when executing the completion notification because the +main thread completion object has been released. + +BUG: unable to handle page fault for address: fffffffffffffff8 +PGD 1f283a067 P4D 1f283a067 PUD 1f283c067 PMD 0 +Oops: 0000 [#1] PREEMPT SMP NOPTI +RIP: 0010:complete_all+0x3e/0xa0 +[...] +Call Trace: + + ? __die_body+0x68/0xb0 + ? page_fault_oops+0x379/0x3e0 + ? exc_page_fault+0x69/0xa0 + ? asm_exc_page_fault+0x22/0x30 + ? complete_all+0x3e/0xa0 + fsm_main_thread+0xa3/0x9c0 [mtk_t7xx (HASH:1400 5)] + ? __pfx_autoremove_wake_function+0x10/0x10 + kthread+0xd8/0x110 + ? __pfx_fsm_main_thread+0x10/0x10 [mtk_t7xx (HASH:1400 5)] + ? __pfx_kthread+0x10/0x10 + ret_from_fork+0x38/0x50 + ? __pfx_kthread+0x10/0x10 + ret_from_fork_asm+0x1b/0x30 + +[...] +CR2: fffffffffffffff8 +---[ end trace 0000000000000000 ]--- + +Use the reference counter to ensure safe release as Sergey suggests: +https://lore.kernel.org/all/da90f64c-260a-4329-87bf-1f9ff20a5951@gmail.com/ + +Fixes: 13e920d93e37 ("net: wwan: t7xx: Add core components") +Signed-off-by: Jinjian Song +Acked-by: Sergey Ryazanov +Link: https://patch.msgid.link/20241224041552.8711-1-jinjian.song@fibocom.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/wwan/t7xx/t7xx_state_monitor.c | 26 ++++++++++++++-------- + drivers/net/wwan/t7xx/t7xx_state_monitor.h | 5 +++-- + 2 files changed, 20 insertions(+), 11 deletions(-) + +diff --git a/drivers/net/wwan/t7xx/t7xx_state_monitor.c b/drivers/net/wwan/t7xx/t7xx_state_monitor.c +index 0bcca08ff2bd..44a2081c5249 100644 +--- a/drivers/net/wwan/t7xx/t7xx_state_monitor.c ++++ b/drivers/net/wwan/t7xx/t7xx_state_monitor.c +@@ -97,14 +97,21 @@ void t7xx_fsm_broadcast_state(struct t7xx_fsm_ctl *ctl, enum md_state state) + fsm_state_notify(ctl->md, state); + } + ++static void fsm_release_command(struct kref *ref) ++{ ++ struct t7xx_fsm_command *cmd = container_of(ref, typeof(*cmd), refcnt); ++ ++ kfree(cmd); ++} ++ + static void fsm_finish_command(struct t7xx_fsm_ctl *ctl, struct t7xx_fsm_command *cmd, int result) + { + if (cmd->flag & FSM_CMD_FLAG_WAIT_FOR_COMPLETION) { +- *cmd->ret = result; +- complete_all(cmd->done); ++ cmd->result = result; ++ complete_all(&cmd->done); + } + +- kfree(cmd); ++ kref_put(&cmd->refcnt, fsm_release_command); + } + + static void fsm_del_kf_event(struct t7xx_fsm_event *event) +@@ -387,7 +394,6 @@ static int fsm_main_thread(void *data) + + int t7xx_fsm_append_cmd(struct t7xx_fsm_ctl *ctl, enum t7xx_fsm_cmd_state cmd_id, unsigned int flag) + { +- DECLARE_COMPLETION_ONSTACK(done); + struct t7xx_fsm_command *cmd; + unsigned long flags; + int ret; +@@ -399,11 +405,13 @@ int t7xx_fsm_append_cmd(struct t7xx_fsm_ctl *ctl, enum t7xx_fsm_cmd_state cmd_id + INIT_LIST_HEAD(&cmd->entry); + cmd->cmd_id = cmd_id; + cmd->flag = flag; ++ kref_init(&cmd->refcnt); + if (flag & FSM_CMD_FLAG_WAIT_FOR_COMPLETION) { +- cmd->done = &done; +- cmd->ret = &ret; ++ init_completion(&cmd->done); ++ kref_get(&cmd->refcnt); + } + ++ kref_get(&cmd->refcnt); + spin_lock_irqsave(&ctl->command_lock, flags); + list_add_tail(&cmd->entry, &ctl->command_queue); + spin_unlock_irqrestore(&ctl->command_lock, flags); +@@ -413,11 +421,11 @@ int t7xx_fsm_append_cmd(struct t7xx_fsm_ctl *ctl, enum t7xx_fsm_cmd_state cmd_id + if (flag & FSM_CMD_FLAG_WAIT_FOR_COMPLETION) { + unsigned long wait_ret; + +- wait_ret = wait_for_completion_timeout(&done, ++ wait_ret = wait_for_completion_timeout(&cmd->done, + msecs_to_jiffies(FSM_CMD_TIMEOUT_MS)); +- if (!wait_ret) +- return -ETIMEDOUT; + ++ ret = wait_ret ? cmd->result : -ETIMEDOUT; ++ kref_put(&cmd->refcnt, fsm_release_command); + return ret; + } + +diff --git a/drivers/net/wwan/t7xx/t7xx_state_monitor.h b/drivers/net/wwan/t7xx/t7xx_state_monitor.h +index b1af0259d4c5..d9f2522e6b2c 100644 +--- a/drivers/net/wwan/t7xx/t7xx_state_monitor.h ++++ b/drivers/net/wwan/t7xx/t7xx_state_monitor.h +@@ -107,8 +107,9 @@ struct t7xx_fsm_command { + struct list_head entry; + enum t7xx_fsm_cmd_state cmd_id; + unsigned int flag; +- struct completion *done; +- int *ret; ++ struct completion done; ++ int result; ++ struct kref refcnt; + }; + + struct t7xx_fsm_notifier { +-- +2.39.5 + diff --git a/queue-6.1/netfilter-nft_set_hash-unaligned-atomic-read-on-stru.patch b/queue-6.1/netfilter-nft_set_hash-unaligned-atomic-read-on-stru.patch new file mode 100644 index 00000000000..296d210c0f0 --- /dev/null +++ b/queue-6.1/netfilter-nft_set_hash-unaligned-atomic-read-on-stru.patch @@ -0,0 +1,96 @@ +From ab9bbf88166199b68697c6d748093ba28ba3f9f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 21 Dec 2024 00:29:20 +0100 +Subject: netfilter: nft_set_hash: unaligned atomic read on struct nft_set_ext + +From: Pablo Neira Ayuso + +[ Upstream commit 542ed8145e6f9392e3d0a86a0e9027d2ffd183e4 ] + +Access to genmask field in struct nft_set_ext results in unaligned +atomic read: + +[ 72.130109] Unable to handle kernel paging request at virtual address ffff0000c2bb708c +[ 72.131036] Mem abort info: +[ 72.131213] ESR = 0x0000000096000021 +[ 72.131446] EC = 0x25: DABT (current EL), IL = 32 bits +[ 72.132209] SET = 0, FnV = 0 +[ 72.133216] EA = 0, S1PTW = 0 +[ 72.134080] FSC = 0x21: alignment fault +[ 72.135593] Data abort info: +[ 72.137194] ISV = 0, ISS = 0x00000021, ISS2 = 0x00000000 +[ 72.142351] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 +[ 72.145989] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 +[ 72.150115] swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000237d27000 +[ 72.154893] [ffff0000c2bb708c] pgd=0000000000000000, p4d=180000023ffff403, pud=180000023f84b403, pmd=180000023f835403, ++pte=0068000102bb7707 +[ 72.163021] Internal error: Oops: 0000000096000021 [#1] SMP +[...] +[ 72.170041] CPU: 7 UID: 0 PID: 54 Comm: kworker/7:0 Tainted: G E 6.13.0-rc3+ #2 +[ 72.170509] Tainted: [E]=UNSIGNED_MODULE +[ 72.170720] Hardware name: QEMU QEMU Virtual Machine, BIOS edk2-stable202302-for-qemu 03/01/2023 +[ 72.171192] Workqueue: events_power_efficient nft_rhash_gc [nf_tables] +[ 72.171552] pstate: 21400005 (nzCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) +[ 72.171915] pc : nft_rhash_gc+0x200/0x2d8 [nf_tables] +[ 72.172166] lr : nft_rhash_gc+0x128/0x2d8 [nf_tables] +[ 72.172546] sp : ffff800081f2bce0 +[ 72.172724] x29: ffff800081f2bd40 x28: ffff0000c2bb708c x27: 0000000000000038 +[ 72.173078] x26: ffff0000c6780ef0 x25: ffff0000c643df00 x24: ffff0000c6778f78 +[ 72.173431] x23: 000000000000001a x22: ffff0000c4b1f000 x21: ffff0000c6780f78 +[ 72.173782] x20: ffff0000c2bb70dc x19: ffff0000c2bb7080 x18: 0000000000000000 +[ 72.174135] x17: ffff0000c0a4e1c0 x16: 0000000000003000 x15: 0000ac26d173b978 +[ 72.174485] x14: ffffffffffffffff x13: 0000000000000030 x12: ffff0000c6780ef0 +[ 72.174841] x11: 0000000000000000 x10: ffff800081f2bcf8 x9 : ffff0000c3000000 +[ 72.175193] x8 : 00000000000004be x7 : 0000000000000000 x6 : 0000000000000000 +[ 72.175544] x5 : 0000000000000040 x4 : ffff0000c3000010 x3 : 0000000000000000 +[ 72.175871] x2 : 0000000000003a98 x1 : ffff0000c2bb708c x0 : 0000000000000004 +[ 72.176207] Call trace: +[ 72.176316] nft_rhash_gc+0x200/0x2d8 [nf_tables] (P) +[ 72.176653] process_one_work+0x178/0x3d0 +[ 72.176831] worker_thread+0x200/0x3f0 +[ 72.176995] kthread+0xe8/0xf8 +[ 72.177130] ret_from_fork+0x10/0x20 +[ 72.177289] Code: 54fff984 d503201f d2800080 91003261 (f820303f) +[ 72.177557] ---[ end trace 0000000000000000 ]--- + +Align struct nft_set_ext to word size to address this and +documentation it. + +pahole reports that this increases the size of elements for rhash and +pipapo in 8 bytes on x86_64. + +Fixes: 7ffc7481153b ("netfilter: nft_set_hash: skip duplicated elements pending gc run") +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + include/net/netfilter/nf_tables.h | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h +index c24b04235d91..d11398aa642e 100644 +--- a/include/net/netfilter/nf_tables.h ++++ b/include/net/netfilter/nf_tables.h +@@ -706,15 +706,18 @@ struct nft_set_ext_tmpl { + /** + * struct nft_set_ext - set extensions + * +- * @genmask: generation mask ++ * @genmask: generation mask, but also flags (see NFT_SET_ELEM_DEAD_BIT) + * @offset: offsets of individual extension types + * @data: beginning of extension data ++ * ++ * This structure must be aligned to word size, otherwise atomic bitops ++ * on genmask field can cause alignment failure on some archs. + */ + struct nft_set_ext { + u8 genmask; + u8 offset[NFT_SET_EXT_NUM]; + char data[]; +-}; ++} __aligned(BITS_PER_LONG / 8); + + static inline void nft_set_ext_prepare(struct nft_set_ext_tmpl *tmpl) + { +-- +2.39.5 + diff --git a/queue-6.1/netrom-check-buffer-length-before-accessing-it.patch b/queue-6.1/netrom-check-buffer-length-before-accessing-it.patch new file mode 100644 index 00000000000..8986a4aae77 --- /dev/null +++ b/queue-6.1/netrom-check-buffer-length-before-accessing-it.patch @@ -0,0 +1,105 @@ +From 72560f620d09b652cea04da071f10a8c54d29c3e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Dec 2024 08:23:07 +0000 +Subject: netrom: check buffer length before accessing it + +From: Ilya Shchipletsov + +[ Upstream commit a4fd163aed2edd967a244499754dec991d8b4c7d ] + +Syzkaller reports an uninit value read from ax25cmp when sending raw message +through ieee802154 implementation. + +===================================================== +BUG: KMSAN: uninit-value in ax25cmp+0x3a5/0x460 net/ax25/ax25_addr.c:119 + ax25cmp+0x3a5/0x460 net/ax25/ax25_addr.c:119 + nr_dev_get+0x20e/0x450 net/netrom/nr_route.c:601 + nr_route_frame+0x1a2/0xfc0 net/netrom/nr_route.c:774 + nr_xmit+0x5a/0x1c0 net/netrom/nr_dev.c:144 + __netdev_start_xmit include/linux/netdevice.h:4940 [inline] + netdev_start_xmit include/linux/netdevice.h:4954 [inline] + xmit_one net/core/dev.c:3548 [inline] + dev_hard_start_xmit+0x247/0xa10 net/core/dev.c:3564 + __dev_queue_xmit+0x33b8/0x5130 net/core/dev.c:4349 + dev_queue_xmit include/linux/netdevice.h:3134 [inline] + raw_sendmsg+0x654/0xc10 net/ieee802154/socket.c:299 + ieee802154_sock_sendmsg+0x91/0xc0 net/ieee802154/socket.c:96 + sock_sendmsg_nosec net/socket.c:730 [inline] + __sock_sendmsg net/socket.c:745 [inline] + ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584 + ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638 + __sys_sendmsg net/socket.c:2667 [inline] + __do_sys_sendmsg net/socket.c:2676 [inline] + __se_sys_sendmsg net/socket.c:2674 [inline] + __x64_sys_sendmsg+0x307/0x490 net/socket.c:2674 + do_syscall_x64 arch/x86/entry/common.c:52 [inline] + do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83 + entry_SYSCALL_64_after_hwframe+0x63/0x6b + +Uninit was created at: + slab_post_alloc_hook+0x129/0xa70 mm/slab.h:768 + slab_alloc_node mm/slub.c:3478 [inline] + kmem_cache_alloc_node+0x5e9/0xb10 mm/slub.c:3523 + kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:560 + __alloc_skb+0x318/0x740 net/core/skbuff.c:651 + alloc_skb include/linux/skbuff.h:1286 [inline] + alloc_skb_with_frags+0xc8/0xbd0 net/core/skbuff.c:6334 + sock_alloc_send_pskb+0xa80/0xbf0 net/core/sock.c:2780 + sock_alloc_send_skb include/net/sock.h:1884 [inline] + raw_sendmsg+0x36d/0xc10 net/ieee802154/socket.c:282 + ieee802154_sock_sendmsg+0x91/0xc0 net/ieee802154/socket.c:96 + sock_sendmsg_nosec net/socket.c:730 [inline] + __sock_sendmsg net/socket.c:745 [inline] + ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584 + ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638 + __sys_sendmsg net/socket.c:2667 [inline] + __do_sys_sendmsg net/socket.c:2676 [inline] + __se_sys_sendmsg net/socket.c:2674 [inline] + __x64_sys_sendmsg+0x307/0x490 net/socket.c:2674 + do_syscall_x64 arch/x86/entry/common.c:52 [inline] + do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83 + entry_SYSCALL_64_after_hwframe+0x63/0x6b + +CPU: 0 PID: 5037 Comm: syz-executor166 Not tainted 6.7.0-rc7-syzkaller-00003-gfbafc3e621c3 #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 +===================================================== + +This issue occurs because the skb buffer is too small, and it's actual +allocation is aligned. This hides an actual issue, which is that nr_route_frame +does not validate the buffer size before using it. + +Fix this issue by checking skb->len before accessing any fields in skb->data. + +Found by Linux Verification Center (linuxtesting.org) with Syzkaller. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Co-developed-by: Nikita Marushkin +Signed-off-by: Nikita Marushkin +Signed-off-by: Ilya Shchipletsov +Link: https://patch.msgid.link/20241219082308.3942-1-rabbelkin@mail.ru +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/netrom/nr_route.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/net/netrom/nr_route.c b/net/netrom/nr_route.c +index bd2b17b219ae..0b270893ee14 100644 +--- a/net/netrom/nr_route.c ++++ b/net/netrom/nr_route.c +@@ -754,6 +754,12 @@ int nr_route_frame(struct sk_buff *skb, ax25_cb *ax25) + int ret; + struct sk_buff *skbn; + ++ /* ++ * Reject malformed packets early. Check that it contains at least 2 ++ * addresses and 1 byte more for Time-To-Live ++ */ ++ if (skb->len < 2 * sizeof(ax25_address) + 1) ++ return 0; + + nr_src = (ax25_address *)(skb->data + 0); + nr_dest = (ax25_address *)(skb->data + 7); +-- +2.39.5 + diff --git a/queue-6.1/rdma-bnxt_re-add-check-for-path-mtu-in-modify_qp.patch b/queue-6.1/rdma-bnxt_re-add-check-for-path-mtu-in-modify_qp.patch new file mode 100644 index 00000000000..00970824e46 --- /dev/null +++ b/queue-6.1/rdma-bnxt_re-add-check-for-path-mtu-in-modify_qp.patch @@ -0,0 +1,64 @@ +From e59c79abfbfdfd0460c5a10a2c4e678d3c9cd208 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Dec 2024 14:09:28 +0530 +Subject: RDMA/bnxt_re: Add check for path mtu in modify_qp + +From: Saravanan Vajravel + +[ Upstream commit 798653a0ee30d3cd495099282751c0f248614ae7 ] + +When RDMA app configures path MTU, add a check in modify_qp verb +to make sure that it doesn't go beyond interface MTU. If this +check fails, driver will fail the modify_qp verb. + +Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver") +Reviewed-by: Kalesh AP +Signed-off-by: Saravanan Vajravel +Signed-off-by: Selvin Xavier +Link: https://patch.msgid.link/20241211083931.968831-3-kalesh-anakkur.purayil@broadcom.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/bnxt_re/ib_verbs.c | 26 +++++++++++++----------- + 1 file changed, 14 insertions(+), 12 deletions(-) + +diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c +index 13102ba93847..01883d67a48e 100644 +--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c ++++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c +@@ -1940,18 +1940,20 @@ int bnxt_re_modify_qp(struct ib_qp *ib_qp, struct ib_qp_attr *qp_attr, + } + } + +- if (qp_attr_mask & IB_QP_PATH_MTU) { +- qp->qplib_qp.modify_flags |= +- CMDQ_MODIFY_QP_MODIFY_MASK_PATH_MTU; +- qp->qplib_qp.path_mtu = __from_ib_mtu(qp_attr->path_mtu); +- qp->qplib_qp.mtu = ib_mtu_enum_to_int(qp_attr->path_mtu); +- } else if (qp_attr->qp_state == IB_QPS_RTR) { +- qp->qplib_qp.modify_flags |= +- CMDQ_MODIFY_QP_MODIFY_MASK_PATH_MTU; +- qp->qplib_qp.path_mtu = +- __from_ib_mtu(iboe_get_mtu(rdev->netdev->mtu)); +- qp->qplib_qp.mtu = +- ib_mtu_enum_to_int(iboe_get_mtu(rdev->netdev->mtu)); ++ if (qp_attr->qp_state == IB_QPS_RTR) { ++ enum ib_mtu qpmtu; ++ ++ qpmtu = iboe_get_mtu(rdev->netdev->mtu); ++ if (qp_attr_mask & IB_QP_PATH_MTU) { ++ if (ib_mtu_enum_to_int(qp_attr->path_mtu) > ++ ib_mtu_enum_to_int(qpmtu)) ++ return -EINVAL; ++ qpmtu = qp_attr->path_mtu; ++ } ++ ++ qp->qplib_qp.modify_flags |= CMDQ_MODIFY_QP_MODIFY_MASK_PATH_MTU; ++ qp->qplib_qp.path_mtu = __from_ib_mtu(qpmtu); ++ qp->qplib_qp.mtu = ib_mtu_enum_to_int(qpmtu); + } + + if (qp_attr_mask & IB_QP_TIMEOUT) { +-- +2.39.5 + diff --git a/queue-6.1/rdma-bnxt_re-fix-max_qp_wrs-reported.patch b/queue-6.1/rdma-bnxt_re-fix-max_qp_wrs-reported.patch new file mode 100644 index 00000000000..f580c1101e2 --- /dev/null +++ b/queue-6.1/rdma-bnxt_re-fix-max_qp_wrs-reported.patch @@ -0,0 +1,42 @@ +From 34835a24f6f0eb30f743e2324b1e4666af579392 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Dec 2024 15:56:45 +0530 +Subject: RDMA/bnxt_re: Fix max_qp_wrs reported + +From: Selvin Xavier + +[ Upstream commit 40be32303ec829ea12f9883e499bfd3fe9e52baf ] + +While creating qps, driver adds one extra entry to the sq size +passed by the ULPs in order to avoid queue full condition. +When ULPs creates QPs with max_qp_wr reported, driver creates +QP with 1 more than the max_wqes supported by HW. Create QP fails +in this case. To avoid this error, reduce 1 entry in max_qp_wqes +and report it to the stack. + +Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver") +Reviewed-by: Kalesh AP +Signed-off-by: Selvin Xavier +Link: https://patch.msgid.link/20241217102649.1377704-2-kalesh-anakkur.purayil@broadcom.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/bnxt_re/qplib_sp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/bnxt_re/qplib_sp.c b/drivers/infiniband/hw/bnxt_re/qplib_sp.c +index bae7d8926143..f59e8755f611 100644 +--- a/drivers/infiniband/hw/bnxt_re/qplib_sp.c ++++ b/drivers/infiniband/hw/bnxt_re/qplib_sp.c +@@ -124,7 +124,7 @@ int bnxt_qplib_get_dev_attr(struct bnxt_qplib_rcfw *rcfw, + attr->max_qp_init_rd_atom = + sb->max_qp_init_rd_atom > BNXT_QPLIB_MAX_OUT_RD_ATOM ? + BNXT_QPLIB_MAX_OUT_RD_ATOM : sb->max_qp_init_rd_atom; +- attr->max_qp_wqes = le16_to_cpu(sb->max_qp_wr); ++ attr->max_qp_wqes = le16_to_cpu(sb->max_qp_wr) - 1; + /* + * 128 WQEs needs to be reserved for the HW (8916). Prevent + * reporting the max number +-- +2.39.5 + diff --git a/queue-6.1/rdma-bnxt_re-fix-reporting-hw_ver-in-query_device.patch b/queue-6.1/rdma-bnxt_re-fix-reporting-hw_ver-in-query_device.patch new file mode 100644 index 00000000000..b0797531ca8 --- /dev/null +++ b/queue-6.1/rdma-bnxt_re-fix-reporting-hw_ver-in-query_device.patch @@ -0,0 +1,41 @@ +From 55750cc0dd99d3d20ddc9b743bd386e0094c38eb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Dec 2024 14:09:31 +0530 +Subject: RDMA/bnxt_re: Fix reporting hw_ver in query_device + +From: Kalesh AP + +[ Upstream commit 7179fe0074a3c962e43a9e51169304c4911989ed ] + +Driver currently populates subsystem_device id in the +"hw_ver" field of ib_attr structure in query_device. + +Updated to populate PCI revision ID. + +Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver") +Reviewed-by: Preethi G +Signed-off-by: Kalesh AP +Signed-off-by: Selvin Xavier +Link: https://patch.msgid.link/20241211083931.968831-6-kalesh-anakkur.purayil@broadcom.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/bnxt_re/ib_verbs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c +index 01883d67a48e..94c34ba103ea 100644 +--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c ++++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c +@@ -138,7 +138,7 @@ int bnxt_re_query_device(struct ib_device *ibdev, + + ib_attr->vendor_id = rdev->en_dev->pdev->vendor; + ib_attr->vendor_part_id = rdev->en_dev->pdev->device; +- ib_attr->hw_ver = rdev->en_dev->pdev->subsystem_device; ++ ib_attr->hw_ver = rdev->en_dev->pdev->revision; + ib_attr->max_qp = dev_attr->max_qp; + ib_attr->max_qp_wr = dev_attr->max_qp_wqes; + ib_attr->device_cap_flags = +-- +2.39.5 + diff --git a/queue-6.1/rdma-bnxt_re-fix-the-locking-while-accessing-the-qp-.patch b/queue-6.1/rdma-bnxt_re-fix-the-locking-while-accessing-the-qp-.patch new file mode 100644 index 00000000000..ae85861cc3c --- /dev/null +++ b/queue-6.1/rdma-bnxt_re-fix-the-locking-while-accessing-the-qp-.patch @@ -0,0 +1,43 @@ +From 95bb297f46515405dd1ed0a3fcc456775cf41c72 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Dec 2024 15:56:49 +0530 +Subject: RDMA/bnxt_re: Fix the locking while accessing the QP table + +From: Selvin Xavier + +[ Upstream commit 9272cba0ded71b5a2084da3004ec7806b8cb7fd2 ] + +QP table handling is synchronized with destroy QP and Async +event from the HW. The same needs to be synchronized +during create_qp also. Use the same lock in create_qp also. + +Fixes: 76d3ddff7153 ("RDMA/bnxt_re: synchronize the qp-handle table array") +Fixes: f218d67ef004 ("RDMA/bnxt_re: Allow posting when QPs are in error") +Fixes: 84cf229f4001 ("RDMA/bnxt_re: Fix the qp table indexing") +Signed-off-by: Selvin Xavier +Link: https://patch.msgid.link/20241217102649.1377704-6-kalesh-anakkur.purayil@broadcom.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/bnxt_re/qplib_fp.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.c b/drivers/infiniband/hw/bnxt_re/qplib_fp.c +index 7bd7ac8d52e6..23f9a48828dc 100644 +--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c ++++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c +@@ -1149,9 +1149,11 @@ int bnxt_qplib_create_qp(struct bnxt_qplib_res *res, struct bnxt_qplib_qp *qp) + rq->dbinfo.db = qp->dpi->dbr; + rq->dbinfo.max_slot = bnxt_qplib_set_rq_max_slot(rq->wqe_size); + } ++ spin_lock_bh(&rcfw->tbl_lock); + tbl_indx = map_qp_id_to_tbl_indx(qp->id, rcfw); + rcfw->qp_tbl[tbl_indx].qp_id = qp->id; + rcfw->qp_tbl[tbl_indx].qp_handle = (void *)qp; ++ spin_unlock_bh(&rcfw->tbl_lock); + + return 0; + fail: +-- +2.39.5 + diff --git a/queue-6.1/rdma-hns-fix-mapping-error-of-zero-hop-wqe-buffer.patch b/queue-6.1/rdma-hns-fix-mapping-error-of-zero-hop-wqe-buffer.patch new file mode 100644 index 00000000000..cbeabbbb376 --- /dev/null +++ b/queue-6.1/rdma-hns-fix-mapping-error-of-zero-hop-wqe-buffer.patch @@ -0,0 +1,177 @@ +From fb1b5b8568c04b98f12046d4c91a82a28dee3516 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Dec 2024 13:52:46 +0800 +Subject: RDMA/hns: Fix mapping error of zero-hop WQE buffer + +From: wenglianfa + +[ Upstream commit 8673a6c2d9e483dfeeef83a1f06f59e05636f4d1 ] + +Due to HW limitation, the three region of WQE buffer must be mapped +and set to HW in a fixed order: SQ buffer, SGE buffer, and RQ buffer. + +Currently when one region is zero-hop while the other two are not, +the zero-hop region will not be mapped. This violate the limitation +above and leads to address error. + +Fixes: 38389eaa4db1 ("RDMA/hns: Add mtr support for mixed multihop addressing") +Signed-off-by: wenglianfa +Signed-off-by: Junxian Huang +Link: https://patch.msgid.link/20241220055249.146943-2-huangjunxian6@hisilicon.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_hem.c | 43 ++++++++++++++++-------- + drivers/infiniband/hw/hns/hns_roce_mr.c | 5 --- + 2 files changed, 29 insertions(+), 19 deletions(-) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_hem.c b/drivers/infiniband/hw/hns/hns_roce_hem.c +index 6e0ca8a4b2a8..f1de497fc977 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_hem.c ++++ b/drivers/infiniband/hw/hns/hns_roce_hem.c +@@ -986,6 +986,7 @@ struct hns_roce_hem_item { + size_t count; /* max ba numbers */ + int start; /* start buf offset in this hem */ + int end; /* end buf offset in this hem */ ++ bool exist_bt; + }; + + /* All HEM items are linked in a tree structure */ +@@ -1014,6 +1015,7 @@ hem_list_alloc_item(struct hns_roce_dev *hr_dev, int start, int end, int count, + } + } + ++ hem->exist_bt = exist_bt; + hem->count = count; + hem->start = start; + hem->end = end; +@@ -1024,22 +1026,22 @@ hem_list_alloc_item(struct hns_roce_dev *hr_dev, int start, int end, int count, + } + + static void hem_list_free_item(struct hns_roce_dev *hr_dev, +- struct hns_roce_hem_item *hem, bool exist_bt) ++ struct hns_roce_hem_item *hem) + { +- if (exist_bt) ++ if (hem->exist_bt) + dma_free_coherent(hr_dev->dev, hem->count * BA_BYTE_LEN, + hem->addr, hem->dma_addr); + kfree(hem); + } + + static void hem_list_free_all(struct hns_roce_dev *hr_dev, +- struct list_head *head, bool exist_bt) ++ struct list_head *head) + { + struct hns_roce_hem_item *hem, *temp_hem; + + list_for_each_entry_safe(hem, temp_hem, head, list) { + list_del(&hem->list); +- hem_list_free_item(hr_dev, hem, exist_bt); ++ hem_list_free_item(hr_dev, hem); + } + } + +@@ -1139,6 +1141,10 @@ int hns_roce_hem_list_calc_root_ba(const struct hns_roce_buf_region *regions, + + for (i = 0; i < region_cnt; i++) { + r = (struct hns_roce_buf_region *)®ions[i]; ++ /* when r->hopnum = 0, the region should not occupy root_ba. */ ++ if (!r->hopnum) ++ continue; ++ + if (r->hopnum > 1) { + step = hem_list_calc_ba_range(r->hopnum, 1, unit); + if (step > 0) +@@ -1232,7 +1238,7 @@ static int hem_list_alloc_mid_bt(struct hns_roce_dev *hr_dev, + + err_exit: + for (level = 1; level < hopnum; level++) +- hem_list_free_all(hr_dev, &temp_list[level], true); ++ hem_list_free_all(hr_dev, &temp_list[level]); + + return ret; + } +@@ -1273,16 +1279,26 @@ static int alloc_fake_root_bt(struct hns_roce_dev *hr_dev, void *cpu_base, + { + struct hns_roce_hem_item *hem; + ++ /* This is on the has_mtt branch, if r->hopnum ++ * is 0, there is no root_ba to reuse for the ++ * region's fake hem, so a dma_alloc request is ++ * necessary here. ++ */ + hem = hem_list_alloc_item(hr_dev, r->offset, r->offset + r->count - 1, +- r->count, false); ++ r->count, !r->hopnum); + if (!hem) + return -ENOMEM; + +- hem_list_assign_bt(hem, cpu_base, phy_base); ++ /* The root_ba can be reused only when r->hopnum > 0. */ ++ if (r->hopnum) ++ hem_list_assign_bt(hem, cpu_base, phy_base); + list_add(&hem->list, branch_head); + list_add(&hem->sibling, leaf_head); + +- return r->count; ++ /* If r->hopnum == 0, 0 is returned, ++ * so that the root_bt entry is not occupied. ++ */ ++ return r->hopnum ? r->count : 0; + } + + static int setup_middle_bt(struct hns_roce_dev *hr_dev, void *cpu_base, +@@ -1326,7 +1342,7 @@ setup_root_hem(struct hns_roce_dev *hr_dev, struct hns_roce_hem_list *hem_list, + return -ENOMEM; + + total = 0; +- for (i = 0; i < region_cnt && total < max_ba_num; i++) { ++ for (i = 0; i < region_cnt && total <= max_ba_num; i++) { + r = ®ions[i]; + if (!r->count) + continue; +@@ -1392,9 +1408,9 @@ static int hem_list_alloc_root_bt(struct hns_roce_dev *hr_dev, + region_cnt); + if (ret) { + for (i = 0; i < region_cnt; i++) +- hem_list_free_all(hr_dev, &head.branch[i], false); ++ hem_list_free_all(hr_dev, &head.branch[i]); + +- hem_list_free_all(hr_dev, &head.root, true); ++ hem_list_free_all(hr_dev, &head.root); + } + + return ret; +@@ -1457,10 +1473,9 @@ void hns_roce_hem_list_release(struct hns_roce_dev *hr_dev, + + for (i = 0; i < HNS_ROCE_MAX_BT_REGION; i++) + for (j = 0; j < HNS_ROCE_MAX_BT_LEVEL; j++) +- hem_list_free_all(hr_dev, &hem_list->mid_bt[i][j], +- j != 0); ++ hem_list_free_all(hr_dev, &hem_list->mid_bt[i][j]); + +- hem_list_free_all(hr_dev, &hem_list->root_bt, true); ++ hem_list_free_all(hr_dev, &hem_list->root_bt); + INIT_LIST_HEAD(&hem_list->btm_bt); + hem_list->root_ba = 0; + } +diff --git a/drivers/infiniband/hw/hns/hns_roce_mr.c b/drivers/infiniband/hw/hns/hns_roce_mr.c +index acdcd5c9f42f..408ef2a96149 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_mr.c ++++ b/drivers/infiniband/hw/hns/hns_roce_mr.c +@@ -767,11 +767,6 @@ int hns_roce_mtr_map(struct hns_roce_dev *hr_dev, struct hns_roce_mtr *mtr, + for (i = 0, mapped_cnt = 0; i < mtr->hem_cfg.region_count && + mapped_cnt < page_cnt; i++) { + r = &mtr->hem_cfg.region[i]; +- /* if hopnum is 0, no need to map pages in this region */ +- if (!r->hopnum) { +- mapped_cnt += r->count; +- continue; +- } + + if (r->offset + r->count > page_cnt) { + ret = -EINVAL; +-- +2.39.5 + diff --git a/queue-6.1/rdma-hns-fix-missing-flush-cqe-for-dwqe.patch b/queue-6.1/rdma-hns-fix-missing-flush-cqe-for-dwqe.patch new file mode 100644 index 00000000000..5306bed16e9 --- /dev/null +++ b/queue-6.1/rdma-hns-fix-missing-flush-cqe-for-dwqe.patch @@ -0,0 +1,58 @@ +From 87f97a7e61d78c5c4ec65421d243758217962be1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Dec 2024 13:52:49 +0800 +Subject: RDMA/hns: Fix missing flush CQE for DWQE + +From: Chengchang Tang + +[ Upstream commit e3debdd48423d3d75b9d366399228d7225d902cd ] + +Flush CQE handler has not been called if QP state gets into errored +mode in DWQE path. So, the new added outstanding WQEs will never be +flushed. + +It leads to a hung task timeout when using NFS over RDMA: + __switch_to+0x7c/0xd0 + __schedule+0x350/0x750 + schedule+0x50/0xf0 + schedule_timeout+0x2c8/0x340 + wait_for_common+0xf4/0x2b0 + wait_for_completion+0x20/0x40 + __ib_drain_sq+0x140/0x1d0 [ib_core] + ib_drain_sq+0x98/0xb0 [ib_core] + rpcrdma_xprt_disconnect+0x68/0x270 [rpcrdma] + xprt_rdma_close+0x20/0x60 [rpcrdma] + xprt_autoclose+0x64/0x1cc [sunrpc] + process_one_work+0x1d8/0x4e0 + worker_thread+0x154/0x420 + kthread+0x108/0x150 + ret_from_fork+0x10/0x18 + +Fixes: 01584a5edcc4 ("RDMA/hns: Add support of direct wqe") +Signed-off-by: Chengchang Tang +Signed-off-by: Junxian Huang +Link: https://patch.msgid.link/20241220055249.146943-5-huangjunxian6@hisilicon.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +index 23667cfbf8e7..ab0dca9d199a 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c ++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +@@ -673,6 +673,10 @@ static void write_dwqe(struct hns_roce_dev *hr_dev, struct hns_roce_qp *qp, + #define HNS_ROCE_SL_SHIFT 2 + struct hns_roce_v2_rc_send_wqe *rc_sq_wqe = wqe; + ++ if (unlikely(qp->state == IB_QPS_ERR)) { ++ flush_cqe(hr_dev, qp); ++ return; ++ } + /* All kinds of DirectWQE have the same header field layout */ + hr_reg_enable(rc_sq_wqe, RC_SEND_WQE_FLAG); + hr_reg_write(rc_sq_wqe, RC_SEND_WQE_DB_SL_L, qp->sl); +-- +2.39.5 + diff --git a/queue-6.1/rdma-hns-fix-warning-storm-caused-by-invalid-input-i.patch b/queue-6.1/rdma-hns-fix-warning-storm-caused-by-invalid-input-i.patch new file mode 100644 index 00000000000..469e962a2a8 --- /dev/null +++ b/queue-6.1/rdma-hns-fix-warning-storm-caused-by-invalid-input-i.patch @@ -0,0 +1,47 @@ +From 25f321ed72e24ad189faa83d4f57f6a8efc506ec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Dec 2024 13:52:48 +0800 +Subject: RDMA/hns: Fix warning storm caused by invalid input in IO path + +From: Chengchang Tang + +[ Upstream commit fa5c4ba8cdbfd2c2d6422e001311c8213283ebbf ] + +WARN_ON() is called in the IO path. And it could lead to a warning +storm. Use WARN_ON_ONCE() instead of WARN_ON(). + +Fixes: 12542f1de179 ("RDMA/hns: Refactor process about opcode in post_send()") +Signed-off-by: Chengchang Tang +Signed-off-by: Junxian Huang +Link: https://patch.msgid.link/20241220055249.146943-4-huangjunxian6@hisilicon.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +index 60628ef1c46e..23667cfbf8e7 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c ++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +@@ -471,7 +471,7 @@ static inline int set_ud_wqe(struct hns_roce_qp *qp, + valid_num_sge = calc_wr_sge_num(wr, &msg_len); + + ret = set_ud_opcode(ud_sq_wqe, wr); +- if (WARN_ON(ret)) ++ if (WARN_ON_ONCE(ret)) + return ret; + + ud_sq_wqe->msg_len = cpu_to_le32(msg_len); +@@ -575,7 +575,7 @@ static inline int set_rc_wqe(struct hns_roce_qp *qp, + rc_sq_wqe->msg_len = cpu_to_le32(msg_len); + + ret = set_rc_opcode(hr_dev, rc_sq_wqe, wr); +- if (WARN_ON(ret)) ++ if (WARN_ON_ONCE(ret)) + return ret; + + hr_reg_write(rc_sq_wqe, RC_SEND_WQE_SO, +-- +2.39.5 + diff --git a/queue-6.1/rdma-hns-refactor-mtr-find.patch b/queue-6.1/rdma-hns-refactor-mtr-find.patch new file mode 100644 index 00000000000..1d2f20f6742 --- /dev/null +++ b/queue-6.1/rdma-hns-refactor-mtr-find.patch @@ -0,0 +1,406 @@ +From 0e9f3c76b5f596b78395f032a6e4deb419b60f24 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 Jan 2024 16:59:30 +0800 +Subject: RDMA/hns: Refactor mtr find + +From: Chengchang Tang + +[ Upstream commit a4ca341080758d847db155b97887bff6f84016a4 ] + +hns_roce_mtr_find() is a collection of multiple functions, and the +return value is also difficult to understand, which is not conducive +to modification and maintenance. + +Separate the function of obtaining MTR root BA from this function. +And some adjustments has been made to improve readability. + +Signed-off-by: Chengchang Tang +Signed-off-by: Junxian Huang +Link: https://lore.kernel.org/r/20240113085935.2838701-2-huangjunxian6@hisilicon.com +Signed-off-by: Leon Romanovsky +Stable-dep-of: 8673a6c2d9e4 ("RDMA/hns: Fix mapping error of zero-hop WQE buffer") +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_cq.c | 11 +-- + drivers/infiniband/hw/hns/hns_roce_device.h | 7 +- + drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 102 ++++++++++---------- + drivers/infiniband/hw/hns/hns_roce_mr.c | 86 +++++++++++------ + 4 files changed, 121 insertions(+), 85 deletions(-) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_cq.c b/drivers/infiniband/hw/hns/hns_roce_cq.c +index 9b91731a6207..5e0d78f4e545 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_cq.c ++++ b/drivers/infiniband/hw/hns/hns_roce_cq.c +@@ -133,14 +133,12 @@ static int alloc_cqc(struct hns_roce_dev *hr_dev, struct hns_roce_cq *hr_cq) + struct hns_roce_cq_table *cq_table = &hr_dev->cq_table; + struct ib_device *ibdev = &hr_dev->ib_dev; + u64 mtts[MTT_MIN_COUNT] = {}; +- dma_addr_t dma_handle; + int ret; + +- ret = hns_roce_mtr_find(hr_dev, &hr_cq->mtr, 0, mtts, ARRAY_SIZE(mtts), +- &dma_handle); +- if (!ret) { ++ ret = hns_roce_mtr_find(hr_dev, &hr_cq->mtr, 0, mtts, ARRAY_SIZE(mtts)); ++ if (ret) { + ibdev_err(ibdev, "failed to find CQ mtr, ret = %d.\n", ret); +- return -EINVAL; ++ return ret; + } + + /* Get CQC memory HEM(Hardware Entry Memory) table */ +@@ -157,7 +155,8 @@ static int alloc_cqc(struct hns_roce_dev *hr_dev, struct hns_roce_cq *hr_cq) + goto err_put; + } + +- ret = hns_roce_create_cqc(hr_dev, hr_cq, mtts, dma_handle); ++ ret = hns_roce_create_cqc(hr_dev, hr_cq, mtts, ++ hns_roce_get_mtr_ba(&hr_cq->mtr)); + if (ret) + goto err_xa; + +diff --git a/drivers/infiniband/hw/hns/hns_roce_device.h b/drivers/infiniband/hw/hns/hns_roce_device.h +index 5b8b68b2d69c..461008bf0fcf 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_device.h ++++ b/drivers/infiniband/hw/hns/hns_roce_device.h +@@ -1117,8 +1117,13 @@ void hns_roce_cmd_use_polling(struct hns_roce_dev *hr_dev); + + /* hns roce hw need current block and next block addr from mtt */ + #define MTT_MIN_COUNT 2 ++static inline dma_addr_t hns_roce_get_mtr_ba(struct hns_roce_mtr *mtr) ++{ ++ return mtr->hem_cfg.root_ba; ++} ++ + int hns_roce_mtr_find(struct hns_roce_dev *hr_dev, struct hns_roce_mtr *mtr, +- u32 offset, u64 *mtt_buf, int mtt_max, u64 *base_addr); ++ u32 offset, u64 *mtt_buf, int mtt_max); + int hns_roce_mtr_create(struct hns_roce_dev *hr_dev, struct hns_roce_mtr *mtr, + struct hns_roce_buf_attr *buf_attr, + unsigned int page_shift, struct ib_udata *udata, +diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +index 54df6c6e4cac..105ad0aec922 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c ++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +@@ -3289,21 +3289,22 @@ static int set_mtpt_pbl(struct hns_roce_dev *hr_dev, + u64 pages[HNS_ROCE_V2_MAX_INNER_MTPT_NUM] = { 0 }; + struct ib_device *ibdev = &hr_dev->ib_dev; + dma_addr_t pbl_ba; +- int i, count; ++ int ret; ++ int i; + +- count = hns_roce_mtr_find(hr_dev, &mr->pbl_mtr, 0, pages, +- min_t(int, ARRAY_SIZE(pages), mr->npages), +- &pbl_ba); +- if (count < 1) { +- ibdev_err(ibdev, "failed to find PBL mtr, count = %d.\n", +- count); +- return -ENOBUFS; ++ ret = hns_roce_mtr_find(hr_dev, &mr->pbl_mtr, 0, pages, ++ min_t(int, ARRAY_SIZE(pages), mr->npages)); ++ if (ret) { ++ ibdev_err(ibdev, "failed to find PBL mtr, ret = %d.\n", ret); ++ return ret; + } + + /* Aligned to the hardware address access unit */ +- for (i = 0; i < count; i++) ++ for (i = 0; i < ARRAY_SIZE(pages); i++) + pages[i] >>= 6; + ++ pbl_ba = hns_roce_get_mtr_ba(&mr->pbl_mtr); ++ + mpt_entry->pbl_size = cpu_to_le32(mr->npages); + mpt_entry->pbl_ba_l = cpu_to_le32(pbl_ba >> 3); + hr_reg_write(mpt_entry, MPT_PBL_BA_H, upper_32_bits(pbl_ba >> 3)); +@@ -3402,18 +3403,12 @@ static int hns_roce_v2_rereg_write_mtpt(struct hns_roce_dev *hr_dev, + static int hns_roce_v2_frmr_write_mtpt(struct hns_roce_dev *hr_dev, + void *mb_buf, struct hns_roce_mr *mr) + { +- struct ib_device *ibdev = &hr_dev->ib_dev; ++ dma_addr_t pbl_ba = hns_roce_get_mtr_ba(&mr->pbl_mtr); + struct hns_roce_v2_mpt_entry *mpt_entry; +- dma_addr_t pbl_ba = 0; + + mpt_entry = mb_buf; + memset(mpt_entry, 0, sizeof(*mpt_entry)); + +- if (hns_roce_mtr_find(hr_dev, &mr->pbl_mtr, 0, NULL, 0, &pbl_ba) < 0) { +- ibdev_err(ibdev, "failed to find frmr mtr.\n"); +- return -ENOBUFS; +- } +- + hr_reg_write(mpt_entry, MPT_ST, V2_MPT_ST_FREE); + hr_reg_write(mpt_entry, MPT_PD, mr->pd); + +@@ -4496,17 +4491,20 @@ static int config_qp_rq_buf(struct hns_roce_dev *hr_dev, + { + u64 mtts[MTT_MIN_COUNT] = { 0 }; + u64 wqe_sge_ba; +- int count; ++ int ret; + + /* Search qp buf's mtts */ +- count = hns_roce_mtr_find(hr_dev, &hr_qp->mtr, hr_qp->rq.offset, mtts, +- MTT_MIN_COUNT, &wqe_sge_ba); +- if (hr_qp->rq.wqe_cnt && count < 1) { ++ ret = hns_roce_mtr_find(hr_dev, &hr_qp->mtr, hr_qp->rq.offset, mtts, ++ MTT_MIN_COUNT); ++ if (hr_qp->rq.wqe_cnt && ret) { + ibdev_err(&hr_dev->ib_dev, +- "failed to find RQ WQE, QPN = 0x%lx.\n", hr_qp->qpn); +- return -EINVAL; ++ "failed to find QP(0x%lx) RQ WQE buf, ret = %d.\n", ++ hr_qp->qpn, ret); ++ return ret; + } + ++ wqe_sge_ba = hns_roce_get_mtr_ba(&hr_qp->mtr); ++ + context->wqe_sge_ba = cpu_to_le32(wqe_sge_ba >> 3); + qpc_mask->wqe_sge_ba = 0; + +@@ -4570,23 +4568,23 @@ static int config_qp_sq_buf(struct hns_roce_dev *hr_dev, + struct ib_device *ibdev = &hr_dev->ib_dev; + u64 sge_cur_blk = 0; + u64 sq_cur_blk = 0; +- int count; ++ int ret; + + /* search qp buf's mtts */ +- count = hns_roce_mtr_find(hr_dev, &hr_qp->mtr, 0, &sq_cur_blk, 1, NULL); +- if (count < 1) { +- ibdev_err(ibdev, "failed to find QP(0x%lx) SQ buf.\n", +- hr_qp->qpn); +- return -EINVAL; ++ ret = hns_roce_mtr_find(hr_dev, &hr_qp->mtr, hr_qp->sq.offset, ++ &sq_cur_blk, 1); ++ if (ret) { ++ ibdev_err(ibdev, "failed to find QP(0x%lx) SQ WQE buf, ret = %d.\n", ++ hr_qp->qpn, ret); ++ return ret; + } + if (hr_qp->sge.sge_cnt > 0) { +- count = hns_roce_mtr_find(hr_dev, &hr_qp->mtr, +- hr_qp->sge.offset, +- &sge_cur_blk, 1, NULL); +- if (count < 1) { +- ibdev_err(ibdev, "failed to find QP(0x%lx) SGE buf.\n", +- hr_qp->qpn); +- return -EINVAL; ++ ret = hns_roce_mtr_find(hr_dev, &hr_qp->mtr, ++ hr_qp->sge.offset, &sge_cur_blk, 1); ++ if (ret) { ++ ibdev_err(ibdev, "failed to find QP(0x%lx) SGE buf, ret = %d.\n", ++ hr_qp->qpn, ret); ++ return ret; + } + } + +@@ -5689,18 +5687,20 @@ static int hns_roce_v2_write_srqc_index_queue(struct hns_roce_srq *srq, + struct ib_device *ibdev = srq->ibsrq.device; + struct hns_roce_dev *hr_dev = to_hr_dev(ibdev); + u64 mtts_idx[MTT_MIN_COUNT] = {}; +- dma_addr_t dma_handle_idx = 0; ++ dma_addr_t dma_handle_idx; + int ret; + + /* Get physical address of idx que buf */ + ret = hns_roce_mtr_find(hr_dev, &idx_que->mtr, 0, mtts_idx, +- ARRAY_SIZE(mtts_idx), &dma_handle_idx); +- if (ret < 1) { ++ ARRAY_SIZE(mtts_idx)); ++ if (ret) { + ibdev_err(ibdev, "failed to find mtr for SRQ idx, ret = %d.\n", + ret); +- return -ENOBUFS; ++ return ret; + } + ++ dma_handle_idx = hns_roce_get_mtr_ba(&idx_que->mtr); ++ + hr_reg_write(ctx, SRQC_IDX_HOP_NUM, + to_hr_hem_hopnum(hr_dev->caps.idx_hop_num, srq->wqe_cnt)); + +@@ -5732,20 +5732,22 @@ static int hns_roce_v2_write_srqc(struct hns_roce_srq *srq, void *mb_buf) + struct hns_roce_dev *hr_dev = to_hr_dev(ibdev); + struct hns_roce_srq_context *ctx = mb_buf; + u64 mtts_wqe[MTT_MIN_COUNT] = {}; +- dma_addr_t dma_handle_wqe = 0; ++ dma_addr_t dma_handle_wqe; + int ret; + + memset(ctx, 0, sizeof(*ctx)); + + /* Get the physical address of srq buf */ + ret = hns_roce_mtr_find(hr_dev, &srq->buf_mtr, 0, mtts_wqe, +- ARRAY_SIZE(mtts_wqe), &dma_handle_wqe); +- if (ret < 1) { ++ ARRAY_SIZE(mtts_wqe)); ++ if (ret) { + ibdev_err(ibdev, "failed to find mtr for SRQ WQE, ret = %d.\n", + ret); +- return -ENOBUFS; ++ return ret; + } + ++ dma_handle_wqe = hns_roce_get_mtr_ba(&srq->buf_mtr); ++ + hr_reg_write(ctx, SRQC_SRQ_ST, 1); + hr_reg_write_bool(ctx, SRQC_SRQ_TYPE, + srq->ibsrq.srq_type == IB_SRQT_XRC); +@@ -6466,7 +6468,7 @@ static int config_eqc(struct hns_roce_dev *hr_dev, struct hns_roce_eq *eq, + u64 eqe_ba[MTT_MIN_COUNT] = { 0 }; + struct hns_roce_eq_context *eqc; + u64 bt_ba = 0; +- int count; ++ int ret; + + eqc = mb_buf; + memset(eqc, 0, sizeof(struct hns_roce_eq_context)); +@@ -6474,13 +6476,15 @@ static int config_eqc(struct hns_roce_dev *hr_dev, struct hns_roce_eq *eq, + init_eq_config(hr_dev, eq); + + /* if not multi-hop, eqe buffer only use one trunk */ +- count = hns_roce_mtr_find(hr_dev, &eq->mtr, 0, eqe_ba, MTT_MIN_COUNT, +- &bt_ba); +- if (count < 1) { +- dev_err(hr_dev->dev, "failed to find EQE mtr\n"); +- return -ENOBUFS; ++ ret = hns_roce_mtr_find(hr_dev, &eq->mtr, 0, eqe_ba, ++ ARRAY_SIZE(eqe_ba)); ++ if (ret) { ++ dev_err(hr_dev->dev, "failed to find EQE mtr, ret = %d\n", ret); ++ return ret; + } + ++ bt_ba = hns_roce_get_mtr_ba(&eq->mtr); ++ + hr_reg_write(eqc, EQC_EQ_ST, HNS_ROCE_V2_EQ_STATE_VALID); + hr_reg_write(eqc, EQC_EQE_HOP_NUM, eq->hop_num); + hr_reg_write(eqc, EQC_OVER_IGNORE, eq->over_ignore); +diff --git a/drivers/infiniband/hw/hns/hns_roce_mr.c b/drivers/infiniband/hw/hns/hns_roce_mr.c +index 7f29a55d378f..7b59b95f87c2 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_mr.c ++++ b/drivers/infiniband/hw/hns/hns_roce_mr.c +@@ -802,47 +802,53 @@ int hns_roce_mtr_map(struct hns_roce_dev *hr_dev, struct hns_roce_mtr *mtr, + return ret; + } + +-int hns_roce_mtr_find(struct hns_roce_dev *hr_dev, struct hns_roce_mtr *mtr, +- u32 offset, u64 *mtt_buf, int mtt_max, u64 *base_addr) ++static int hns_roce_get_direct_addr_mtt(struct hns_roce_hem_cfg *cfg, ++ u32 start_index, u64 *mtt_buf, ++ int mtt_cnt) + { +- struct hns_roce_hem_cfg *cfg = &mtr->hem_cfg; +- int mtt_count, left; +- u32 start_index; ++ int mtt_count; + int total = 0; +- __le64 *mtts; + u32 npage; + u64 addr; + +- if (!mtt_buf || mtt_max < 1) +- goto done; +- +- /* no mtt memory in direct mode, so just return the buffer address */ +- if (cfg->is_direct) { +- start_index = offset >> HNS_HW_PAGE_SHIFT; +- for (mtt_count = 0; mtt_count < cfg->region_count && +- total < mtt_max; mtt_count++) { +- npage = cfg->region[mtt_count].offset; +- if (npage < start_index) +- continue; ++ if (mtt_cnt > cfg->region_count) ++ return -EINVAL; + +- addr = cfg->root_ba + (npage << HNS_HW_PAGE_SHIFT); +- mtt_buf[total] = addr; ++ for (mtt_count = 0; mtt_count < cfg->region_count && total < mtt_cnt; ++ mtt_count++) { ++ npage = cfg->region[mtt_count].offset; ++ if (npage < start_index) ++ continue; + +- total++; +- } ++ addr = cfg->root_ba + (npage << HNS_HW_PAGE_SHIFT); ++ mtt_buf[total] = addr; + +- goto done; ++ total++; + } + +- start_index = offset >> cfg->buf_pg_shift; +- left = mtt_max; ++ if (!total) ++ return -ENOENT; ++ ++ return 0; ++} ++ ++static int hns_roce_get_mhop_mtt(struct hns_roce_dev *hr_dev, ++ struct hns_roce_mtr *mtr, u32 start_index, ++ u64 *mtt_buf, int mtt_cnt) ++{ ++ int left = mtt_cnt; ++ int total = 0; ++ int mtt_count; ++ __le64 *mtts; ++ u32 npage; ++ + while (left > 0) { + mtt_count = 0; + mtts = hns_roce_hem_list_find_mtt(hr_dev, &mtr->hem_list, + start_index + total, + &mtt_count); + if (!mtts || !mtt_count) +- goto done; ++ break; + + npage = min(mtt_count, left); + left -= npage; +@@ -850,11 +856,33 @@ int hns_roce_mtr_find(struct hns_roce_dev *hr_dev, struct hns_roce_mtr *mtr, + mtt_buf[total++] = le64_to_cpu(mtts[mtt_count]); + } + +-done: +- if (base_addr) +- *base_addr = cfg->root_ba; ++ if (!total) ++ return -ENOENT; ++ ++ return 0; ++} ++ ++int hns_roce_mtr_find(struct hns_roce_dev *hr_dev, struct hns_roce_mtr *mtr, ++ u32 offset, u64 *mtt_buf, int mtt_max) ++{ ++ struct hns_roce_hem_cfg *cfg = &mtr->hem_cfg; ++ u32 start_index; ++ int ret; ++ ++ if (!mtt_buf || mtt_max < 1) ++ return -EINVAL; + +- return total; ++ /* no mtt memory in direct mode, so just return the buffer address */ ++ if (cfg->is_direct) { ++ start_index = offset >> HNS_HW_PAGE_SHIFT; ++ ret = hns_roce_get_direct_addr_mtt(cfg, start_index, ++ mtt_buf, mtt_max); ++ } else { ++ start_index = offset >> cfg->buf_pg_shift; ++ ret = hns_roce_get_mhop_mtt(hr_dev, mtr, start_index, ++ mtt_buf, mtt_max); ++ } ++ return ret; + } + + static int mtr_init_buf_cfg(struct hns_roce_dev *hr_dev, +-- +2.39.5 + diff --git a/queue-6.1/rdma-hns-remove-unused-parameters-and-variables.patch b/queue-6.1/rdma-hns-remove-unused-parameters-and-variables.patch new file mode 100644 index 00000000000..2d7e5086c83 --- /dev/null +++ b/queue-6.1/rdma-hns-remove-unused-parameters-and-variables.patch @@ -0,0 +1,268 @@ +From 97d6fcb0e41abfdb3d4a0da0cdd39a768185eb8f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Apr 2024 17:16:08 +0800 +Subject: RDMA/hns: Remove unused parameters and variables + +From: Chengchang Tang + +[ Upstream commit f4caa864af84f801a5821ea2ba6c1cc46f8252c1 ] + +Remove unused parameters and variables. + +Signed-off-by: Chengchang Tang +Signed-off-by: Junxian Huang +Link: https://lore.kernel.org/r/20240412091616.370789-3-huangjunxian6@hisilicon.com +Signed-off-by: Leon Romanovsky +Stable-dep-of: 8673a6c2d9e4 ("RDMA/hns: Fix mapping error of zero-hop WQE buffer") +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_alloc.c | 3 +-- + drivers/infiniband/hw/hns/hns_roce_device.h | 5 ++--- + drivers/infiniband/hw/hns/hns_roce_hem.c | 13 +++++-------- + drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 20 +++++++------------- + drivers/infiniband/hw/hns/hns_roce_mr.c | 4 ++-- + drivers/infiniband/hw/hns/hns_roce_qp.c | 4 +--- + drivers/infiniband/hw/hns/hns_roce_srq.c | 4 ++-- + 7 files changed, 20 insertions(+), 33 deletions(-) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_alloc.c b/drivers/infiniband/hw/hns/hns_roce_alloc.c +index 11a78ceae568..950c133d4220 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_alloc.c ++++ b/drivers/infiniband/hw/hns/hns_roce_alloc.c +@@ -153,8 +153,7 @@ int hns_roce_get_kmem_bufs(struct hns_roce_dev *hr_dev, dma_addr_t *bufs, + return total; + } + +-int hns_roce_get_umem_bufs(struct hns_roce_dev *hr_dev, dma_addr_t *bufs, +- int buf_cnt, struct ib_umem *umem, ++int hns_roce_get_umem_bufs(dma_addr_t *bufs, int buf_cnt, struct ib_umem *umem, + unsigned int page_shift) + { + struct ib_block_iter biter; +diff --git a/drivers/infiniband/hw/hns/hns_roce_device.h b/drivers/infiniband/hw/hns/hns_roce_device.h +index 461008bf0fcf..060797001353 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_device.h ++++ b/drivers/infiniband/hw/hns/hns_roce_device.h +@@ -882,8 +882,7 @@ struct hns_roce_hw { + int (*rereg_write_mtpt)(struct hns_roce_dev *hr_dev, + struct hns_roce_mr *mr, int flags, + void *mb_buf); +- int (*frmr_write_mtpt)(struct hns_roce_dev *hr_dev, void *mb_buf, +- struct hns_roce_mr *mr); ++ int (*frmr_write_mtpt)(void *mb_buf, struct hns_roce_mr *mr); + int (*mw_write_mtpt)(void *mb_buf, struct hns_roce_mw *mw); + void (*write_cqc)(struct hns_roce_dev *hr_dev, + struct hns_roce_cq *hr_cq, void *mb_buf, u64 *mtts, +@@ -1182,7 +1181,7 @@ struct hns_roce_buf *hns_roce_buf_alloc(struct hns_roce_dev *hr_dev, u32 size, + int hns_roce_get_kmem_bufs(struct hns_roce_dev *hr_dev, dma_addr_t *bufs, + int buf_cnt, struct hns_roce_buf *buf, + unsigned int page_shift); +-int hns_roce_get_umem_bufs(struct hns_roce_dev *hr_dev, dma_addr_t *bufs, ++int hns_roce_get_umem_bufs(dma_addr_t *bufs, + int buf_cnt, struct ib_umem *umem, + unsigned int page_shift); + +diff --git a/drivers/infiniband/hw/hns/hns_roce_hem.c b/drivers/infiniband/hw/hns/hns_roce_hem.c +index f605eb8fd13a..6e0ca8a4b2a8 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_hem.c ++++ b/drivers/infiniband/hw/hns/hns_roce_hem.c +@@ -1043,15 +1043,13 @@ static void hem_list_free_all(struct hns_roce_dev *hr_dev, + } + } + +-static void hem_list_link_bt(struct hns_roce_dev *hr_dev, void *base_addr, +- u64 table_addr) ++static void hem_list_link_bt(void *base_addr, u64 table_addr) + { + *(u64 *)(base_addr) = table_addr; + } + + /* assign L0 table address to hem from root bt */ +-static void hem_list_assign_bt(struct hns_roce_dev *hr_dev, +- struct hns_roce_hem_item *hem, void *cpu_addr, ++static void hem_list_assign_bt(struct hns_roce_hem_item *hem, void *cpu_addr, + u64 phy_addr) + { + hem->addr = cpu_addr; +@@ -1222,8 +1220,7 @@ static int hem_list_alloc_mid_bt(struct hns_roce_dev *hr_dev, + if (level > 1) { + pre = hem_ptrs[level - 1]; + step = (cur->start - pre->start) / step * BA_BYTE_LEN; +- hem_list_link_bt(hr_dev, pre->addr + step, +- cur->dma_addr); ++ hem_list_link_bt(pre->addr + step, cur->dma_addr); + } + } + +@@ -1281,7 +1278,7 @@ static int alloc_fake_root_bt(struct hns_roce_dev *hr_dev, void *cpu_base, + if (!hem) + return -ENOMEM; + +- hem_list_assign_bt(hr_dev, hem, cpu_base, phy_base); ++ hem_list_assign_bt(hem, cpu_base, phy_base); + list_add(&hem->list, branch_head); + list_add(&hem->sibling, leaf_head); + +@@ -1304,7 +1301,7 @@ static int setup_middle_bt(struct hns_roce_dev *hr_dev, void *cpu_base, + /* if exist mid bt, link L1 to L0 */ + list_for_each_entry_safe(hem, temp_hem, branch_head, list) { + offset = (hem->start - r->offset) / step * BA_BYTE_LEN; +- hem_list_link_bt(hr_dev, cpu_base + offset, hem->dma_addr); ++ hem_list_link_bt(cpu_base + offset, hem->dma_addr); + total++; + } + +diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +index 105ad0aec922..60628ef1c46e 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c ++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +@@ -3400,8 +3400,7 @@ static int hns_roce_v2_rereg_write_mtpt(struct hns_roce_dev *hr_dev, + return ret; + } + +-static int hns_roce_v2_frmr_write_mtpt(struct hns_roce_dev *hr_dev, +- void *mb_buf, struct hns_roce_mr *mr) ++static int hns_roce_v2_frmr_write_mtpt(void *mb_buf, struct hns_roce_mr *mr) + { + dma_addr_t pbl_ba = hns_roce_get_mtr_ba(&mr->pbl_mtr); + struct hns_roce_v2_mpt_entry *mpt_entry; +@@ -4367,8 +4366,7 @@ static void set_access_flags(struct hns_roce_qp *hr_qp, + } + + static void set_qpc_wqe_cnt(struct hns_roce_qp *hr_qp, +- struct hns_roce_v2_qp_context *context, +- struct hns_roce_v2_qp_context *qpc_mask) ++ struct hns_roce_v2_qp_context *context) + { + hr_reg_write(context, QPC_SGE_SHIFT, + to_hr_hem_entries_shift(hr_qp->sge.sge_cnt, +@@ -4390,7 +4388,6 @@ static inline int get_pdn(struct ib_pd *ib_pd) + } + + static void modify_qp_reset_to_init(struct ib_qp *ibqp, +- const struct ib_qp_attr *attr, + struct hns_roce_v2_qp_context *context, + struct hns_roce_v2_qp_context *qpc_mask) + { +@@ -4409,7 +4406,7 @@ static void modify_qp_reset_to_init(struct ib_qp *ibqp, + + hr_reg_write(context, QPC_RQWS, ilog2(hr_qp->rq.max_gs)); + +- set_qpc_wqe_cnt(hr_qp, context, qpc_mask); ++ set_qpc_wqe_cnt(hr_qp, context); + + /* No VLAN need to set 0xFFF */ + hr_reg_write(context, QPC_VLAN_ID, 0xfff); +@@ -4454,7 +4451,6 @@ static void modify_qp_reset_to_init(struct ib_qp *ibqp, + } + + static void modify_qp_init_to_init(struct ib_qp *ibqp, +- const struct ib_qp_attr *attr, + struct hns_roce_v2_qp_context *context, + struct hns_roce_v2_qp_context *qpc_mask) + { +@@ -4752,8 +4748,7 @@ static int modify_qp_init_to_rtr(struct ib_qp *ibqp, + return 0; + } + +-static int modify_qp_rtr_to_rts(struct ib_qp *ibqp, +- const struct ib_qp_attr *attr, int attr_mask, ++static int modify_qp_rtr_to_rts(struct ib_qp *ibqp, int attr_mask, + struct hns_roce_v2_qp_context *context, + struct hns_roce_v2_qp_context *qpc_mask) + { +@@ -5121,15 +5116,14 @@ static int hns_roce_v2_set_abs_fields(struct ib_qp *ibqp, + + if (cur_state == IB_QPS_RESET && new_state == IB_QPS_INIT) { + memset(qpc_mask, 0, hr_dev->caps.qpc_sz); +- modify_qp_reset_to_init(ibqp, attr, context, qpc_mask); ++ modify_qp_reset_to_init(ibqp, context, qpc_mask); + } else if (cur_state == IB_QPS_INIT && new_state == IB_QPS_INIT) { +- modify_qp_init_to_init(ibqp, attr, context, qpc_mask); ++ modify_qp_init_to_init(ibqp, context, qpc_mask); + } else if (cur_state == IB_QPS_INIT && new_state == IB_QPS_RTR) { + ret = modify_qp_init_to_rtr(ibqp, attr, attr_mask, context, + qpc_mask); + } else if (cur_state == IB_QPS_RTR && new_state == IB_QPS_RTS) { +- ret = modify_qp_rtr_to_rts(ibqp, attr, attr_mask, context, +- qpc_mask); ++ ret = modify_qp_rtr_to_rts(ibqp, attr_mask, context, qpc_mask); + } + + return ret; +diff --git a/drivers/infiniband/hw/hns/hns_roce_mr.c b/drivers/infiniband/hw/hns/hns_roce_mr.c +index 7b59b95f87c2..acdcd5c9f42f 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_mr.c ++++ b/drivers/infiniband/hw/hns/hns_roce_mr.c +@@ -154,7 +154,7 @@ static int hns_roce_mr_enable(struct hns_roce_dev *hr_dev, + if (mr->type != MR_TYPE_FRMR) + ret = hr_dev->hw->write_mtpt(hr_dev, mailbox->buf, mr); + else +- ret = hr_dev->hw->frmr_write_mtpt(hr_dev, mailbox->buf, mr); ++ ret = hr_dev->hw->frmr_write_mtpt(mailbox->buf, mr); + if (ret) { + dev_err(dev, "failed to write mtpt, ret = %d.\n", ret); + goto err_page; +@@ -714,7 +714,7 @@ static int mtr_map_bufs(struct hns_roce_dev *hr_dev, struct hns_roce_mtr *mtr, + return -ENOMEM; + + if (mtr->umem) +- npage = hns_roce_get_umem_bufs(hr_dev, pages, page_count, ++ npage = hns_roce_get_umem_bufs(pages, page_count, + mtr->umem, page_shift); + else + npage = hns_roce_get_kmem_bufs(hr_dev, pages, page_count, +diff --git a/drivers/infiniband/hw/hns/hns_roce_qp.c b/drivers/infiniband/hw/hns/hns_roce_qp.c +index 7af663176104..19136cb16960 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_qp.c ++++ b/drivers/infiniband/hw/hns/hns_roce_qp.c +@@ -1139,7 +1139,6 @@ static int set_qp_param(struct hns_roce_dev *hr_dev, struct hns_roce_qp *hr_qp, + } + + static int hns_roce_create_qp_common(struct hns_roce_dev *hr_dev, +- struct ib_pd *ib_pd, + struct ib_qp_init_attr *init_attr, + struct ib_udata *udata, + struct hns_roce_qp *hr_qp) +@@ -1293,7 +1292,6 @@ int hns_roce_create_qp(struct ib_qp *qp, struct ib_qp_init_attr *init_attr, + struct ib_device *ibdev = qp->device; + struct hns_roce_dev *hr_dev = to_hr_dev(ibdev); + struct hns_roce_qp *hr_qp = to_hr_qp(qp); +- struct ib_pd *pd = qp->pd; + int ret; + + ret = check_qp_type(hr_dev, init_attr->qp_type, !!udata); +@@ -1308,7 +1306,7 @@ int hns_roce_create_qp(struct ib_qp *qp, struct ib_qp_init_attr *init_attr, + hr_qp->phy_port = hr_dev->iboe.phy_port[hr_qp->port]; + } + +- ret = hns_roce_create_qp_common(hr_dev, pd, init_attr, udata, hr_qp); ++ ret = hns_roce_create_qp_common(hr_dev, init_attr, udata, hr_qp); + if (ret) + ibdev_err(ibdev, "create QP type 0x%x failed(%d)\n", + init_attr->qp_type, ret); +diff --git a/drivers/infiniband/hw/hns/hns_roce_srq.c b/drivers/infiniband/hw/hns/hns_roce_srq.c +index 652508b660a0..80fcb1b0e8fd 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_srq.c ++++ b/drivers/infiniband/hw/hns/hns_roce_srq.c +@@ -249,7 +249,7 @@ static void free_srq_wqe_buf(struct hns_roce_dev *hr_dev, + hns_roce_mtr_destroy(hr_dev, &srq->buf_mtr); + } + +-static int alloc_srq_wrid(struct hns_roce_dev *hr_dev, struct hns_roce_srq *srq) ++static int alloc_srq_wrid(struct hns_roce_srq *srq) + { + srq->wrid = kvmalloc_array(srq->wqe_cnt, sizeof(u64), GFP_KERNEL); + if (!srq->wrid) +@@ -365,7 +365,7 @@ static int alloc_srq_buf(struct hns_roce_dev *hr_dev, struct hns_roce_srq *srq, + goto err_idx; + + if (!udata) { +- ret = alloc_srq_wrid(hr_dev, srq); ++ ret = alloc_srq_wrid(srq); + if (ret) + goto err_wqe_buf; + } +-- +2.39.5 + diff --git a/queue-6.1/rdma-mlx5-enforce-same-type-port-association-for-mul.patch b/queue-6.1/rdma-mlx5-enforce-same-type-port-association-for-mul.patch new file mode 100644 index 00000000000..b9269e15d33 --- /dev/null +++ b/queue-6.1/rdma-mlx5-enforce-same-type-port-association-for-mul.patch @@ -0,0 +1,69 @@ +From 09d5926ceee5fd08fdfd888e3774381acaa4730a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Dec 2024 15:45:37 +0200 +Subject: RDMA/mlx5: Enforce same type port association for multiport RoCE + +From: Patrisious Haddad + +[ Upstream commit e05feab22fd7dabcd6d272c4e2401ec1acdfdb9b ] + +Different core device types such as PFs and VFs shouldn't be affiliated +together since they have different capabilities, fix that by enforcing +type check before doing the affiliation. + +Fixes: 32f69e4be269 ("{net, IB}/mlx5: Manage port association for multiport RoCE") +Reviewed-by: Mark Bloch +Signed-off-by: Patrisious Haddad +Link: https://patch.msgid.link/88699500f690dff1c1852c1ddb71f8a1cc8b956e.1733233480.git.leonro@nvidia.com +Reviewed-by: Mateusz Polchlopek +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx5/main.c | 6 ++++-- + include/linux/mlx5/driver.h | 6 ++++++ + 2 files changed, 10 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c +index bce31e28eb30..45a414e8d35f 100644 +--- a/drivers/infiniband/hw/mlx5/main.c ++++ b/drivers/infiniband/hw/mlx5/main.c +@@ -3265,7 +3265,8 @@ static int mlx5_ib_init_multiport_master(struct mlx5_ib_dev *dev) + list_for_each_entry(mpi, &mlx5_ib_unaffiliated_port_list, + list) { + if (dev->sys_image_guid == mpi->sys_image_guid && +- (mlx5_core_native_port_num(mpi->mdev) - 1) == i) { ++ (mlx5_core_native_port_num(mpi->mdev) - 1) == i && ++ mlx5_core_same_coredev_type(dev->mdev, mpi->mdev)) { + bound = mlx5_ib_bind_slave_port(dev, mpi); + } + +@@ -4280,7 +4281,8 @@ static int mlx5r_mp_probe(struct auxiliary_device *adev, + + mutex_lock(&mlx5_ib_multiport_mutex); + list_for_each_entry(dev, &mlx5_ib_dev_list, ib_dev_list) { +- if (dev->sys_image_guid == mpi->sys_image_guid) ++ if (dev->sys_image_guid == mpi->sys_image_guid && ++ mlx5_core_same_coredev_type(dev->mdev, mpi->mdev)) + bound = mlx5_ib_bind_slave_port(dev, mpi); + + if (bound) { +diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h +index 1cae12185cf0..2588ddd3512b 100644 +--- a/include/linux/mlx5/driver.h ++++ b/include/linux/mlx5/driver.h +@@ -1212,6 +1212,12 @@ static inline bool mlx5_core_is_vf(const struct mlx5_core_dev *dev) + return dev->coredev_type == MLX5_COREDEV_VF; + } + ++static inline bool mlx5_core_same_coredev_type(const struct mlx5_core_dev *dev1, ++ const struct mlx5_core_dev *dev2) ++{ ++ return dev1->coredev_type == dev2->coredev_type; ++} ++ + static inline bool mlx5_core_is_ecpf(const struct mlx5_core_dev *dev) + { + return dev->caps.embedded_cpu; +-- +2.39.5 + diff --git a/queue-6.1/rdma-rtrs-ensure-ib_sge-list-is-accessible.patch b/queue-6.1/rdma-rtrs-ensure-ib_sge-list-is-accessible.patch new file mode 100644 index 00000000000..29bb6c87763 --- /dev/null +++ b/queue-6.1/rdma-rtrs-ensure-ib_sge-list-is-accessible.patch @@ -0,0 +1,71 @@ +From 281a6bd8533bf8b85b04ec3816cfd2e6c3c6009e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 Dec 2024 09:34:16 +0800 +Subject: RDMA/rtrs: Ensure 'ib_sge list' is accessible + +From: Li Zhijian + +[ Upstream commit fb514b31395946022f13a08e06a435f53cf9e8b3 ] + +Move the declaration of the 'ib_sge list' variable outside the +'always_invalidate' block to ensure it remains accessible for use +throughout the function. + +Previously, 'ib_sge list' was declared within the 'always_invalidate' +block, limiting its accessibility, then caused a +'BUG: kernel NULL pointer dereference'[1]. + ? __die_body.cold+0x19/0x27 + ? page_fault_oops+0x15a/0x2d0 + ? search_module_extables+0x19/0x60 + ? search_bpf_extables+0x5f/0x80 + ? exc_page_fault+0x7e/0x180 + ? asm_exc_page_fault+0x26/0x30 + ? memcpy_orig+0xd5/0x140 + rxe_mr_copy+0x1c3/0x200 [rdma_rxe] + ? rxe_pool_get_index+0x4b/0x80 [rdma_rxe] + copy_data+0xa5/0x230 [rdma_rxe] + rxe_requester+0xd9b/0xf70 [rdma_rxe] + ? finish_task_switch.isra.0+0x99/0x2e0 + rxe_sender+0x13/0x40 [rdma_rxe] + do_task+0x68/0x1e0 [rdma_rxe] + process_one_work+0x177/0x330 + worker_thread+0x252/0x390 + ? __pfx_worker_thread+0x10/0x10 + +This change ensures the variable is available for subsequent operations +that require it. + +[1] https://lore.kernel.org/linux-rdma/6a1f3e8f-deb0-49f9-bc69-a9b03ecfcda7@fujitsu.com/ + +Fixes: 9cb837480424 ("RDMA/rtrs: server: main functionality") +Signed-off-by: Li Zhijian +Link: https://patch.msgid.link/20241231013416.1290920-1-lizhijian@fujitsu.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/ulp/rtrs/rtrs-srv.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/ulp/rtrs/rtrs-srv.c b/drivers/infiniband/ulp/rtrs/rtrs-srv.c +index a70ccb4d4c85..8b3b9b798676 100644 +--- a/drivers/infiniband/ulp/rtrs/rtrs-srv.c ++++ b/drivers/infiniband/ulp/rtrs/rtrs-srv.c +@@ -344,6 +344,7 @@ static int send_io_resp_imm(struct rtrs_srv_con *con, struct rtrs_srv_op *id, + struct rtrs_srv_mr *srv_mr; + bool need_inval = false; + enum ib_send_flags flags; ++ struct ib_sge list; + u32 imm; + int err; + +@@ -396,7 +397,6 @@ static int send_io_resp_imm(struct rtrs_srv_con *con, struct rtrs_srv_op *id, + imm = rtrs_to_io_rsp_imm(id->msg_id, errno, need_inval); + imm_wr.wr.next = NULL; + if (always_invalidate) { +- struct ib_sge list; + struct rtrs_msg_rkey_rsp *msg; + + srv_mr = &srv_path->mrs[id->msg_id]; +-- +2.39.5 + diff --git a/queue-6.1/series b/queue-6.1/series index 81fe0498742..31d283e383c 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -9,3 +9,42 @@ xhci-retry-stop-endpoint-on-buggy-nec-controllers.patch usb-xhci-limit-stop-endpoint-retries.patch xhci-turn-nec-specific-quirk-for-handling-stop-endpo.patch net-mctp-handle-skb-cleanup-on-sock_queue-failures.patch +rdma-mlx5-enforce-same-type-port-association-for-mul.patch +rdma-bnxt_re-add-check-for-path-mtu-in-modify_qp.patch +rdma-bnxt_re-fix-reporting-hw_ver-in-query_device.patch +rdma-bnxt_re-fix-max_qp_wrs-reported.patch +rdma-bnxt_re-fix-the-locking-while-accessing-the-qp-.patch +drm-bridge-adv7511_audio-update-audio-infoframe-prop.patch +net-dsa-microchip-fix-ksz9477-set_ageing_time-functi.patch +net-dsa-microchip-add-ksz_rmw8-function.patch +net-dsa-microchip-fix-lan937x-set_ageing_time-functi.patch +rdma-hns-refactor-mtr-find.patch +rdma-hns-remove-unused-parameters-and-variables.patch +rdma-hns-fix-mapping-error-of-zero-hop-wqe-buffer.patch +rdma-hns-fix-warning-storm-caused-by-invalid-input-i.patch +rdma-hns-fix-missing-flush-cqe-for-dwqe.patch +net-stmmac-platform-provide-devm_stmmac_probe_config.patch +net-stmmac-don-t-create-a-mdio-bus-if-unnecessary.patch +net-stmmac-restructure-the-error-path-of-stmmac_prob.patch +net-fix-memory-leak-in-tcp_conn_request.patch +ipip-ip_tunnel-sit-add-fou-support-for-externally-co.patch +ip_tunnel-annotate-data-races-around-t-parms.link.patch +ipv4-ip_tunnel-unmask-upper-dscp-bits-in-ip_tunnel_b.patch +ipv4-ip_tunnel-unmask-upper-dscp-bits-in-ip_md_tunne.patch +ipv4-ip_tunnel-unmask-upper-dscp-bits-in-ip_tunnel_x.patch +net-fix-netns-for-ip_tunnel_init_flow.patch +netrom-check-buffer-length-before-accessing-it.patch +drm-i915-dg1-fix-power-gate-sequence.patch +netfilter-nft_set_hash-unaligned-atomic-read-on-stru.patch +net-llc-reset-skb-transport_header.patch +alsa-usb-audio-us16x08-initialize-array-before-use.patch +eth-bcmsysport-fix-call-balance-of-priv-clk-handling.patch +net-mv643xx_eth-fix-an-of-node-reference-leak.patch +net-wwan-t7xx-fix-fsm-command-timeout-issue.patch +rdma-rtrs-ensure-ib_sge-list-is-accessible.patch +net-reenable-netif_f_ipv6_csum-offload-for-big-tcp-p.patch +net-restrict-so_reuseport-to-inet-sockets.patch +net-wwan-iosm-properly-check-for-valid-exec-stage-in.patch +af_packet-fix-vlan_get_tci-vs-msg_peek.patch +af_packet-fix-vlan_get_protocol_dgram-vs-msg_peek.patch +ila-serialize-calls-to-nf_register_net_hooks.patch