From: Sasha Levin Date: Mon, 19 Aug 2024 14:19:32 +0000 (-0400) Subject: Fixes for 5.10 X-Git-Tag: v6.1.107~114 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=813e61114287459768ab48b334dbcac2be74d32b;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.10 Signed-off-by: Sasha Levin --- diff --git a/queue-5.10/alsa-hda-realtek-fix-noise-from-speakers-on-lenovo-i.patch b/queue-5.10/alsa-hda-realtek-fix-noise-from-speakers-on-lenovo-i.patch new file mode 100644 index 00000000000..85835a5d61e --- /dev/null +++ b/queue-5.10/alsa-hda-realtek-fix-noise-from-speakers-on-lenovo-i.patch @@ -0,0 +1,39 @@ +From 87c752603f8fb61143facb1a7472ec0f44cd41f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Aug 2024 18:39:06 +0330 +Subject: ALSA: hda/realtek: Fix noise from speakers on Lenovo IdeaPad 3 15IAU7 + +From: Parsa Poorshikhian + +[ Upstream commit ef9718b3d54e822de294351251f3a574f8a082ce ] + +Fix noise from speakers connected to AUX port when no sound is playing. +The problem occurs because the `alc_shutup_pins` function includes +a 0x10ec0257 vendor ID, which causes noise on Lenovo IdeaPad 3 15IAU7 with +Realtek ALC257 codec when no sound is playing. +Removing this vendor ID from the function fixes the bug. + +Fixes: 70794b9563fe ("ALSA: hda/realtek: Add more codec ID to no shutup pins list") +Signed-off-by: Parsa Poorshikhian +Link: https://patch.msgid.link/20240810150939.330693-1-parsa.poorsh@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_realtek.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index e8e9cfb4a9357..04fd52bba0573 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -578,7 +578,6 @@ static void alc_shutup_pins(struct hda_codec *codec) + switch (codec->core.vendor_id) { + case 0x10ec0236: + case 0x10ec0256: +- case 0x10ec0257: + case 0x19e58326: + case 0x10ec0283: + case 0x10ec0285: +-- +2.43.0 + diff --git a/queue-5.10/atm-idt77252-prevent-use-after-free-in-dequeue_rx.patch b/queue-5.10/atm-idt77252-prevent-use-after-free-in-dequeue_rx.patch new file mode 100644 index 00000000000..f59471c850a --- /dev/null +++ b/queue-5.10/atm-idt77252-prevent-use-after-free-in-dequeue_rx.patch @@ -0,0 +1,56 @@ +From ed7dc0aefa46b5604e6006f46438955f725f5c16 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Aug 2024 15:28:19 +0300 +Subject: atm: idt77252: prevent use after free in dequeue_rx() + +From: Dan Carpenter + +[ Upstream commit a9a18e8f770c9b0703dab93580d0b02e199a4c79 ] + +We can't dereference "skb" after calling vcc->push() because the skb +is released. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Dan Carpenter +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/atm/idt77252.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/atm/idt77252.c b/drivers/atm/idt77252.c +index e616e33c8a209..25fd73fafb371 100644 +--- a/drivers/atm/idt77252.c ++++ b/drivers/atm/idt77252.c +@@ -1118,8 +1118,8 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe) + rpp->len += skb->len; + + if (stat & SAR_RSQE_EPDU) { ++ unsigned int len, truesize; + unsigned char *l1l2; +- unsigned int len; + + l1l2 = (unsigned char *) ((unsigned long) skb->data + skb->len - 6); + +@@ -1189,14 +1189,15 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe) + ATM_SKB(skb)->vcc = vcc; + __net_timestamp(skb); + ++ truesize = skb->truesize; + vcc->push(vcc, skb); + atomic_inc(&vcc->stats->rx); + +- if (skb->truesize > SAR_FB_SIZE_3) ++ if (truesize > SAR_FB_SIZE_3) + add_rx_skb(card, 3, SAR_FB_SIZE_3, 1); +- else if (skb->truesize > SAR_FB_SIZE_2) ++ else if (truesize > SAR_FB_SIZE_2) + add_rx_skb(card, 2, SAR_FB_SIZE_2, 1); +- else if (skb->truesize > SAR_FB_SIZE_1) ++ else if (truesize > SAR_FB_SIZE_1) + add_rx_skb(card, 1, SAR_FB_SIZE_1, 1); + else + add_rx_skb(card, 0, SAR_FB_SIZE_0, 1); +-- +2.43.0 + diff --git a/queue-5.10/fixup-net-dsa-microchip-fix-initial-port-flush-probl.patch b/queue-5.10/fixup-net-dsa-microchip-fix-initial-port-flush-probl.patch new file mode 100644 index 00000000000..b625848441c --- /dev/null +++ b/queue-5.10/fixup-net-dsa-microchip-fix-initial-port-flush-probl.patch @@ -0,0 +1,25 @@ +From 55b9fe592cf10d3055738f07aeda531d89542a82 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 18 Aug 2024 06:23:26 -0400 +Subject: fixup! net: dsa: microchip: fix initial port flush problem + +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/microchip/ksz9477.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/net/dsa/microchip/ksz9477.c b/drivers/net/dsa/microchip/ksz9477.c +index 535b64155320a..4d0c2be652ae4 100644 +--- a/drivers/net/dsa/microchip/ksz9477.c ++++ b/drivers/net/dsa/microchip/ksz9477.c +@@ -195,7 +195,6 @@ static int ksz9477_wait_alu_sta_ready(struct ksz_device *dev) + + static int ksz9477_reset_switch(struct ksz_device *dev) + { +- u8 data8; + u32 data32; + + /* reset switch */ +-- +2.43.0 + diff --git a/queue-5.10/mptcp-correct-mptcp_subflow_attr_ssn_offset-reserved.patch b/queue-5.10/mptcp-correct-mptcp_subflow_attr_ssn_offset-reserved.patch new file mode 100644 index 00000000000..269d4200471 --- /dev/null +++ b/queue-5.10/mptcp-correct-mptcp_subflow_attr_ssn_offset-reserved.patch @@ -0,0 +1,42 @@ +From 1c8f8f01d8339ec54fd59b0c114a35fbb0c88994 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Aug 2024 08:51:23 +0200 +Subject: mptcp: correct MPTCP_SUBFLOW_ATTR_SSN_OFFSET reserved size + +From: Eugene Syromiatnikov + +[ Upstream commit 655111b838cdabdb604f3625a9ff08c5eedb11da ] + +ssn_offset field is u32 and is placed into the netlink response with +nla_put_u32(), but only 2 bytes are reserved for the attribute payload +in subflow_get_info_size() (even though it makes no difference +in the end, as it is aligned up to 4 bytes). Supply the correct +argument to the relevant nla_total_size() call to make it less +confusing. + +Fixes: 5147dfb50832 ("mptcp: allow dumping subflow context to userspace") +Signed-off-by: Eugene Syromiatnikov +Reviewed-by: Matthieu Baerts (NGI0) +Link: https://patch.msgid.link/20240812065024.GA19719@asgard.redhat.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/mptcp/diag.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/mptcp/diag.c b/net/mptcp/diag.c +index d7ca71c597545..23bd18084c8a2 100644 +--- a/net/mptcp/diag.c ++++ b/net/mptcp/diag.c +@@ -95,7 +95,7 @@ static size_t subflow_get_info_size(const struct sock *sk) + nla_total_size(4) + /* MPTCP_SUBFLOW_ATTR_RELWRITE_SEQ */ + nla_total_size_64bit(8) + /* MPTCP_SUBFLOW_ATTR_MAP_SEQ */ + nla_total_size(4) + /* MPTCP_SUBFLOW_ATTR_MAP_SFSEQ */ +- nla_total_size(2) + /* MPTCP_SUBFLOW_ATTR_SSN_OFFSET */ ++ nla_total_size(4) + /* MPTCP_SUBFLOW_ATTR_SSN_OFFSET */ + nla_total_size(2) + /* MPTCP_SUBFLOW_ATTR_MAP_DATALEN */ + nla_total_size(4) + /* MPTCP_SUBFLOW_ATTR_FLAGS */ + nla_total_size(1) + /* MPTCP_SUBFLOW_ATTR_ID_REM */ +-- +2.43.0 + diff --git a/queue-5.10/net-axienet-fix-register-defines-comment-description.patch b/queue-5.10/net-axienet-fix-register-defines-comment-description.patch new file mode 100644 index 00000000000..aef4c44ea9a --- /dev/null +++ b/queue-5.10/net-axienet-fix-register-defines-comment-description.patch @@ -0,0 +1,62 @@ +From 2c5c070d93e6369ef30e78f816d2657fb8bd2f82 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Aug 2024 11:56:09 +0530 +Subject: net: axienet: Fix register defines comment description + +From: Radhey Shyam Pandey + +[ Upstream commit 9ff2f816e2aa65ca9a1cdf0954842f8173c0f48d ] + +In axiethernet header fix register defines comment description to be +inline with IP documentation. It updates MAC configuration register, +MDIO configuration register and frame filter control description. + +Fixes: 8a3b7a252dca ("drivers/net/ethernet/xilinx: added Xilinx AXI Ethernet driver") +Signed-off-by: Radhey Shyam Pandey +Reviewed-by: Andrew Lunn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/xilinx/xilinx_axienet.h | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet.h b/drivers/net/ethernet/xilinx/xilinx_axienet.h +index 7326ad4d5e1c7..c0c93d0e3c7f9 100644 +--- a/drivers/net/ethernet/xilinx/xilinx_axienet.h ++++ b/drivers/net/ethernet/xilinx/xilinx_axienet.h +@@ -159,16 +159,16 @@ + #define XAE_RCW1_OFFSET 0x00000404 /* Rx Configuration Word 1 */ + #define XAE_TC_OFFSET 0x00000408 /* Tx Configuration */ + #define XAE_FCC_OFFSET 0x0000040C /* Flow Control Configuration */ +-#define XAE_EMMC_OFFSET 0x00000410 /* EMAC mode configuration */ +-#define XAE_PHYC_OFFSET 0x00000414 /* RGMII/SGMII configuration */ ++#define XAE_EMMC_OFFSET 0x00000410 /* MAC speed configuration */ ++#define XAE_PHYC_OFFSET 0x00000414 /* RX Max Frame Configuration */ + #define XAE_ID_OFFSET 0x000004F8 /* Identification register */ +-#define XAE_MDIO_MC_OFFSET 0x00000500 /* MII Management Config */ +-#define XAE_MDIO_MCR_OFFSET 0x00000504 /* MII Management Control */ +-#define XAE_MDIO_MWD_OFFSET 0x00000508 /* MII Management Write Data */ +-#define XAE_MDIO_MRD_OFFSET 0x0000050C /* MII Management Read Data */ ++#define XAE_MDIO_MC_OFFSET 0x00000500 /* MDIO Setup */ ++#define XAE_MDIO_MCR_OFFSET 0x00000504 /* MDIO Control */ ++#define XAE_MDIO_MWD_OFFSET 0x00000508 /* MDIO Write Data */ ++#define XAE_MDIO_MRD_OFFSET 0x0000050C /* MDIO Read Data */ + #define XAE_UAW0_OFFSET 0x00000700 /* Unicast address word 0 */ + #define XAE_UAW1_OFFSET 0x00000704 /* Unicast address word 1 */ +-#define XAE_FMI_OFFSET 0x00000708 /* Filter Mask Index */ ++#define XAE_FMI_OFFSET 0x00000708 /* Frame Filter Control */ + #define XAE_AF0_OFFSET 0x00000710 /* Address Filter 0 */ + #define XAE_AF1_OFFSET 0x00000714 /* Address Filter 1 */ + +@@ -307,7 +307,7 @@ + */ + #define XAE_UAW1_UNICASTADDR_MASK 0x0000FFFF + +-/* Bit masks for Axi Ethernet FMI register */ ++/* Bit masks for Axi Ethernet FMC register */ + #define XAE_FMI_PM_MASK 0x80000000 /* Promis. mode enable */ + #define XAE_FMI_IND_MASK 0x00000003 /* Index Mask */ + +-- +2.43.0 + diff --git a/queue-5.10/net-dsa-vsc73xx-check-busy-flag-in-mdio-operations.patch b/queue-5.10/net-dsa-vsc73xx-check-busy-flag-in-mdio-operations.patch new file mode 100644 index 00000000000..247a19a8e67 --- /dev/null +++ b/queue-5.10/net-dsa-vsc73xx-check-busy-flag-in-mdio-operations.patch @@ -0,0 +1,114 @@ +From 249499bcb88d505ba168229ce88cabb3e315eb42 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Aug 2024 21:38:04 +0200 +Subject: net: dsa: vsc73xx: check busy flag in MDIO operations + +From: Pawel Dembicki + +[ Upstream commit fa63c6434b6f6aaf9d8d599dc899bc0a074cc0ad ] + +The VSC73xx has a busy flag used during MDIO operations. It is raised +when MDIO read/write operations are in progress. Without it, PHYs are +misconfigured and bus operations do not work as expected. + +Fixes: 05bd97fc559d ("net: dsa: Add Vitesse VSC73xx DSA router driver") +Reviewed-by: Linus Walleij +Reviewed-by: Florian Fainelli +Signed-off-by: Pawel Dembicki +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/vitesse-vsc73xx-core.c | 37 +++++++++++++++++++++++++- + 1 file changed, 36 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/dsa/vitesse-vsc73xx-core.c b/drivers/net/dsa/vitesse-vsc73xx-core.c +index d050dfaf327cc..8a21902212e04 100644 +--- a/drivers/net/dsa/vitesse-vsc73xx-core.c ++++ b/drivers/net/dsa/vitesse-vsc73xx-core.c +@@ -39,6 +39,10 @@ + #define VSC73XX_BLOCK_ARBITER 0x5 /* Only subblock 0 */ + #define VSC73XX_BLOCK_SYSTEM 0x7 /* Only subblock 0 */ + ++/* MII Block subblock */ ++#define VSC73XX_BLOCK_MII_INTERNAL 0x0 /* Internal MDIO subblock */ ++#define VSC73XX_BLOCK_MII_EXTERNAL 0x1 /* External MDIO subblock */ ++ + #define CPU_PORT 6 /* CPU port */ + + /* MAC Block registers */ +@@ -197,6 +201,8 @@ + #define VSC73XX_MII_CMD 0x1 + #define VSC73XX_MII_DATA 0x2 + ++#define VSC73XX_MII_STAT_BUSY BIT(3) ++ + /* Arbiter block 5 registers */ + #define VSC73XX_ARBEMPTY 0x0c + #define VSC73XX_ARBDISC 0x0e +@@ -271,6 +277,7 @@ + #define IS_739X(a) (IS_7395(a) || IS_7398(a)) + + #define VSC73XX_POLL_SLEEP_US 1000 ++#define VSC73XX_MDIO_POLL_SLEEP_US 5 + #define VSC73XX_POLL_TIMEOUT_US 10000 + + struct vsc73xx_counter { +@@ -488,6 +495,22 @@ static int vsc73xx_detect(struct vsc73xx *vsc) + return 0; + } + ++static int vsc73xx_mdio_busy_check(struct vsc73xx *vsc) ++{ ++ int ret, err; ++ u32 val; ++ ++ ret = read_poll_timeout(vsc73xx_read, err, ++ err < 0 || !(val & VSC73XX_MII_STAT_BUSY), ++ VSC73XX_MDIO_POLL_SLEEP_US, ++ VSC73XX_POLL_TIMEOUT_US, false, vsc, ++ VSC73XX_BLOCK_MII, VSC73XX_BLOCK_MII_INTERNAL, ++ VSC73XX_MII_STAT, &val); ++ if (ret) ++ return ret; ++ return err; ++} ++ + static int vsc73xx_phy_read(struct dsa_switch *ds, int phy, int regnum) + { + struct vsc73xx *vsc = ds->priv; +@@ -495,12 +518,20 @@ static int vsc73xx_phy_read(struct dsa_switch *ds, int phy, int regnum) + u32 val; + int ret; + ++ ret = vsc73xx_mdio_busy_check(vsc); ++ if (ret) ++ return ret; ++ + /* Setting bit 26 means "read" */ + cmd = BIT(26) | (phy << 21) | (regnum << 16); + ret = vsc73xx_write(vsc, VSC73XX_BLOCK_MII, 0, 1, cmd); + if (ret) + return ret; +- msleep(2); ++ ++ ret = vsc73xx_mdio_busy_check(vsc); ++ if (ret) ++ return ret; ++ + ret = vsc73xx_read(vsc, VSC73XX_BLOCK_MII, 0, 2, &val); + if (ret) + return ret; +@@ -524,6 +555,10 @@ static int vsc73xx_phy_write(struct dsa_switch *ds, int phy, int regnum, + u32 cmd; + int ret; + ++ ret = vsc73xx_mdio_busy_check(vsc); ++ if (ret) ++ return ret; ++ + /* It was found through tedious experiments that this router + * chip really hates to have it's PHYs reset. They + * never recover if that happens: autonegotiation stops +-- +2.43.0 + diff --git a/queue-5.10/net-dsa-vsc73xx-pass-value-in-phy_write-operation.patch b/queue-5.10/net-dsa-vsc73xx-pass-value-in-phy_write-operation.patch new file mode 100644 index 00000000000..498a89e46f8 --- /dev/null +++ b/queue-5.10/net-dsa-vsc73xx-pass-value-in-phy_write-operation.patch @@ -0,0 +1,40 @@ +From 57800fa079d0129dac49e1d158a8ff59e00375bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Aug 2024 21:38:03 +0200 +Subject: net: dsa: vsc73xx: pass value in phy_write operation + +From: Pawel Dembicki + +[ Upstream commit 5b9eebc2c7a5f0cc7950d918c1e8a4ad4bed5010 ] + +In the 'vsc73xx_phy_write' function, the register value is missing, +and the phy write operation always sends zeros. + +This commit passes the value variable into the proper register. + +Fixes: 05bd97fc559d ("net: dsa: Add Vitesse VSC73xx DSA router driver") +Reviewed-by: Linus Walleij +Reviewed-by: Florian Fainelli +Signed-off-by: Pawel Dembicki +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/vitesse-vsc73xx-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/dsa/vitesse-vsc73xx-core.c b/drivers/net/dsa/vitesse-vsc73xx-core.c +index 018988b95035e..55c1063327a8f 100644 +--- a/drivers/net/dsa/vitesse-vsc73xx-core.c ++++ b/drivers/net/dsa/vitesse-vsc73xx-core.c +@@ -531,7 +531,7 @@ static int vsc73xx_phy_write(struct dsa_switch *ds, int phy, int regnum, + return 0; + } + +- cmd = (phy << 21) | (regnum << 16); ++ cmd = (phy << 21) | (regnum << 16) | val; + ret = vsc73xx_write(vsc, VSC73XX_BLOCK_MII, 0, 1, cmd); + if (ret) + return ret; +-- +2.43.0 + diff --git a/queue-5.10/net-dsa-vsc73xx-use-read_poll_timeout-instead-delay-.patch b/queue-5.10/net-dsa-vsc73xx-use-read_poll_timeout-instead-delay-.patch new file mode 100644 index 00000000000..d385271ad13 --- /dev/null +++ b/queue-5.10/net-dsa-vsc73xx-use-read_poll_timeout-instead-delay-.patch @@ -0,0 +1,100 @@ +From 35daa54c953022545ca5d65ee8e5b7b4daf39578 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Apr 2024 22:50:44 +0200 +Subject: net: dsa: vsc73xx: use read_poll_timeout instead delay loop + +From: Pawel Dembicki + +[ Upstream commit eb7e33d01db3aec128590391b2397384bab406b6 ] + +Switch the delay loop during the Arbiter empty check from +vsc73xx_adjust_link() to use read_poll_timeout(). Functionally, +one msleep() call is eliminated at the end of the loop in the timeout +case. + +As Russell King suggested: + +"This [change] avoids the issue that on the last iteration, the code reads +the register, tests it, finds the condition that's being waiting for is +false, _then_ waits and end up printing the error message - that last +wait is rather useless, and as the arbiter state isn't checked after +waiting, it could be that we had success during the last wait." + +Suggested-by: Russell King +Reviewed-by: Andrew Lunn +Reviewed-by: Linus Walleij +Reviewed-by: Florian Fainelli +Signed-off-by: Pawel Dembicki +Link: https://lore.kernel.org/r/20240417205048.3542839-2-paweldembicki@gmail.com +Signed-off-by: Jakub Kicinski +Stable-dep-of: fa63c6434b6f ("net: dsa: vsc73xx: check busy flag in MDIO operations") +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/vitesse-vsc73xx-core.c | 30 ++++++++++++++------------ + 1 file changed, 16 insertions(+), 14 deletions(-) + +diff --git a/drivers/net/dsa/vitesse-vsc73xx-core.c b/drivers/net/dsa/vitesse-vsc73xx-core.c +index 55c1063327a8f..d050dfaf327cc 100644 +--- a/drivers/net/dsa/vitesse-vsc73xx-core.c ++++ b/drivers/net/dsa/vitesse-vsc73xx-core.c +@@ -17,6 +17,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -269,6 +270,9 @@ + #define IS_7398(a) ((a)->chipid == VSC73XX_CHIPID_ID_7398) + #define IS_739X(a) (IS_7395(a) || IS_7398(a)) + ++#define VSC73XX_POLL_SLEEP_US 1000 ++#define VSC73XX_POLL_TIMEOUT_US 10000 ++ + struct vsc73xx_counter { + u8 counter; + const char *name; +@@ -780,7 +784,7 @@ static void vsc73xx_adjust_link(struct dsa_switch *ds, int port, + * after a PHY or the CPU port comes up or down. + */ + if (!phydev->link) { +- int maxloop = 10; ++ int ret, err; + + dev_dbg(vsc->dev, "port %d: went down\n", + port); +@@ -795,19 +799,17 @@ static void vsc73xx_adjust_link(struct dsa_switch *ds, int port, + VSC73XX_ARBDISC, BIT(port), BIT(port)); + + /* Wait until queue is empty */ +- vsc73xx_read(vsc, VSC73XX_BLOCK_ARBITER, 0, +- VSC73XX_ARBEMPTY, &val); +- while (!(val & BIT(port))) { +- msleep(1); +- vsc73xx_read(vsc, VSC73XX_BLOCK_ARBITER, 0, +- VSC73XX_ARBEMPTY, &val); +- if (--maxloop == 0) { +- dev_err(vsc->dev, +- "timeout waiting for block arbiter\n"); +- /* Continue anyway */ +- break; +- } +- } ++ ret = read_poll_timeout(vsc73xx_read, err, ++ err < 0 || (val & BIT(port)), ++ VSC73XX_POLL_SLEEP_US, ++ VSC73XX_POLL_TIMEOUT_US, false, ++ vsc, VSC73XX_BLOCK_ARBITER, 0, ++ VSC73XX_ARBEMPTY, &val); ++ if (ret) ++ dev_err(vsc->dev, ++ "timeout waiting for block arbiter\n"); ++ else if (err < 0) ++ dev_err(vsc->dev, "error reading arbiter\n"); + + /* Put this port into reset */ + vsc73xx_write(vsc, VSC73XX_BLOCK_MAC, port, VSC73XX_MAC_CFG, +-- +2.43.0 + diff --git a/queue-5.10/net-hns3-fix-a-deadlock-problem-when-config-tc-durin.patch b/queue-5.10/net-hns3-fix-a-deadlock-problem-when-config-tc-durin.patch new file mode 100644 index 00000000000..8a8a28e32b3 --- /dev/null +++ b/queue-5.10/net-hns3-fix-a-deadlock-problem-when-config-tc-durin.patch @@ -0,0 +1,76 @@ +From 691bcd5288dcae39d44447e16a7393adb9e27846 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Aug 2024 22:10:22 +0800 +Subject: net: hns3: fix a deadlock problem when config TC during resetting +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jie Wang + +[ Upstream commit be5e816d00a506719e9dbb1a9c861c5ced30a109 ] + +When config TC during the reset process, may cause a deadlock, the flow is +as below: + pf reset start + │ + ▼ + ...... +setup tc │ + │ ▼ + ▼ DOWN: napi_disable() +napi_disable()(skip) │ + │ │ + ▼ ▼ + ...... ...... + │ │ + ▼ │ +napi_enable() │ + ▼ + UINIT: netif_napi_del() + │ + ▼ + ...... + │ + ▼ + INIT: netif_napi_add() + │ + ▼ + ...... global reset start + │ │ + ▼ ▼ + UP: napi_enable()(skip) ...... + │ │ + ▼ ▼ + ...... napi_disable() + +In reset process, the driver will DOWN the port and then UINIT, in this +case, the setup tc process will UP the port before UINIT, so cause the +problem. Adds a DOWN process in UINIT to fix it. + +Fixes: bb6b94a896d4 ("net: hns3: Add reset interface implementation in client") +Signed-off-by: Jie Wang +Signed-off-by: Jijie Shao +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +index f8275534205a7..9ff5179b4d879 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +@@ -4536,6 +4536,9 @@ static int hns3_reset_notify_uninit_enet(struct hnae3_handle *handle) + struct hns3_nic_priv *priv = netdev_priv(netdev); + int ret; + ++ if (!test_bit(HNS3_NIC_STATE_DOWN, &priv->state)) ++ hns3_nic_net_stop(netdev); ++ + if (!test_and_clear_bit(HNS3_NIC_STATE_INITED, &priv->state)) { + netdev_warn(netdev, "already uninitialized\n"); + return 0; +-- +2.43.0 + diff --git a/queue-5.10/net-hns3-fix-wrong-use-of-semaphore-up.patch b/queue-5.10/net-hns3-fix-wrong-use-of-semaphore-up.patch new file mode 100644 index 00000000000..9899e2c0d2c --- /dev/null +++ b/queue-5.10/net-hns3-fix-wrong-use-of-semaphore-up.patch @@ -0,0 +1,61 @@ +From c3341cc30b1fafd540410d9156a23fe2e9b76da5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Aug 2024 22:10:20 +0800 +Subject: net: hns3: fix wrong use of semaphore up + +From: Jie Wang + +[ Upstream commit 8445d9d3c03101859663d34fda747f6a50947556 ] + +Currently, if hns3 PF or VF FLR reset failed after five times retry, +the reset done process will directly release the semaphore +which has already released in hclge_reset_prepare_general. +This will cause down operation fail. + +So this patch fixes it by adding reset state judgement. The up operation is +only called after successful PF FLR reset. + +Fixes: 8627bdedc435 ("net: hns3: refactor the precedure of PF FLR") +Fixes: f28368bb4542 ("net: hns3: refactor the procedure of VF FLR") +Signed-off-by: Jie Wang +Signed-off-by: Jijie Shao +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 4 ++-- + drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +index 5dbee850fef53..885793707a5f1 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +@@ -10051,8 +10051,8 @@ static void hclge_flr_done(struct hnae3_ae_dev *ae_dev) + dev_err(&hdev->pdev->dev, "fail to rebuild, ret=%d\n", ret); + + hdev->reset_type = HNAE3_NONE_RESET; +- clear_bit(HCLGE_STATE_RST_HANDLING, &hdev->state); +- up(&hdev->reset_sem); ++ if (test_and_clear_bit(HCLGE_STATE_RST_HANDLING, &hdev->state)) ++ up(&hdev->reset_sem); + } + + static void hclge_clear_resetting_state(struct hclge_dev *hdev) +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c +index be41117ec1465..755935f9efc81 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c +@@ -2093,8 +2093,8 @@ static void hclgevf_flr_done(struct hnae3_ae_dev *ae_dev) + ret); + + hdev->reset_type = HNAE3_NONE_RESET; +- clear_bit(HCLGEVF_STATE_RST_HANDLING, &hdev->state); +- up(&hdev->reset_sem); ++ if (test_and_clear_bit(HCLGEVF_STATE_RST_HANDLING, &hdev->state)) ++ up(&hdev->reset_sem); + } + + static u32 hclgevf_get_fw_version(struct hnae3_handle *handle) +-- +2.43.0 + diff --git a/queue-5.10/net-mlx5e-correctly-report-errors-for-ethtool-rx-flo.patch b/queue-5.10/net-mlx5e-correctly-report-errors-for-ethtool-rx-flo.patch new file mode 100644 index 00000000000..bcc26c99f45 --- /dev/null +++ b/queue-5.10/net-mlx5e-correctly-report-errors-for-ethtool-rx-flo.patch @@ -0,0 +1,46 @@ +From 7babfb68cc925f38adc5b1e8b7b5e30af9d84737 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Aug 2024 17:41:05 +0300 +Subject: net/mlx5e: Correctly report errors for ethtool rx flows + +From: Cosmin Ratiu + +[ Upstream commit cbc796be1779c4dbc9a482c7233995e2a8b6bfb3 ] + +Previously, an ethtool rx flow with no attrs would not be added to the +NIC as it has no rules to configure the hw with, but it would be +reported as successful to the caller (return code 0). This is confusing +for the user as ethtool then reports "Added rule $num", but no rule was +actually added. + +This change corrects that by instead reporting these wrong rules as +-EINVAL. + +Fixes: b29c61dac3a2 ("net/mlx5e: Ethtool steering flow validation refactoring") +Signed-off-by: Cosmin Ratiu +Reviewed-by: Saeed Mahameed +Reviewed-by: Dragos Tatulea +Signed-off-by: Tariq Toukan +Link: https://patch.msgid.link/20240808144107.2095424-5-tariqt@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/en_fs_ethtool.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_fs_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_fs_ethtool.c +index b416a8ee2eed2..26631bca5ab85 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_fs_ethtool.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_fs_ethtool.c +@@ -679,7 +679,7 @@ mlx5e_ethtool_flow_replace(struct mlx5e_priv *priv, + if (num_tuples <= 0) { + netdev_warn(priv->netdev, "%s: flow is not valid %d\n", + __func__, num_tuples); +- return num_tuples; ++ return num_tuples < 0 ? num_tuples : -EINVAL; + } + + eth_ft = get_flow_table(priv, fs, num_tuples); +-- +2.43.0 + diff --git a/queue-5.10/netfilter-allow-ipv6-fragments-to-arrive-on-differen.patch b/queue-5.10/netfilter-allow-ipv6-fragments-to-arrive-on-differen.patch new file mode 100644 index 00000000000..faa493ca2cb --- /dev/null +++ b/queue-5.10/netfilter-allow-ipv6-fragments-to-arrive-on-differen.patch @@ -0,0 +1,46 @@ +From 087501643bc2fb347e799289b538675a1d4ec218 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Aug 2024 12:40:52 +0100 +Subject: netfilter: allow ipv6 fragments to arrive on different devices + +From: Tom Hughes + +[ Upstream commit 3cd740b985963f874a1a094f1969e998b9d05554 ] + +Commit 264640fc2c5f4 ("ipv6: distinguish frag queues by device +for multicast and link-local packets") modified the ipv6 fragment +reassembly logic to distinguish frag queues by device for multicast +and link-local packets but in fact only the main reassembly code +limits the use of the device to those address types and the netfilter +reassembly code uses the device for all packets. + +This means that if fragments of a packet arrive on different interfaces +then netfilter will fail to reassemble them and the fragments will be +expired without going any further through the filters. + +Fixes: 648700f76b03 ("inet: frags: use rhashtables for reassembly units") +Signed-off-by: Tom Hughes +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/ipv6/netfilter/nf_conntrack_reasm.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c +index a0108415275fe..73c0b92bdf0ac 100644 +--- a/net/ipv6/netfilter/nf_conntrack_reasm.c ++++ b/net/ipv6/netfilter/nf_conntrack_reasm.c +@@ -155,6 +155,10 @@ static struct frag_queue *fq_find(struct net *net, __be32 id, u32 user, + }; + struct inet_frag_queue *q; + ++ if (!(ipv6_addr_type(&hdr->daddr) & (IPV6_ADDR_MULTICAST | ++ IPV6_ADDR_LINKLOCAL))) ++ key.iif = 0; ++ + q = inet_frag_find(nf_frag->fqdir, &key); + if (!q) + return NULL; +-- +2.43.0 + diff --git a/queue-5.10/netfilter-flowtable-initialise-extack-before-use.patch b/queue-5.10/netfilter-flowtable-initialise-extack-before-use.patch new file mode 100644 index 00000000000..d95509c4759 --- /dev/null +++ b/queue-5.10/netfilter-flowtable-initialise-extack-before-use.patch @@ -0,0 +1,37 @@ +From 3a39742450781ac17d2a23da6f0079d4a7cb486a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Aug 2024 17:16:37 +0100 +Subject: netfilter: flowtable: initialise extack before use + +From: Donald Hunter + +[ Upstream commit e9767137308daf906496613fd879808a07f006a2 ] + +Fix missing initialisation of extack in flow offload. + +Fixes: c29f74e0df7a ("netfilter: nf_flow_table: hardware offload support") +Signed-off-by: Donald Hunter +Reviewed-by: Simon Horman +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_flow_table_offload.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/netfilter/nf_flow_table_offload.c b/net/netfilter/nf_flow_table_offload.c +index 746ca77d0aad6..f6275d93f8a51 100644 +--- a/net/netfilter/nf_flow_table_offload.c ++++ b/net/netfilter/nf_flow_table_offload.c +@@ -682,8 +682,8 @@ static int nf_flow_offload_tuple(struct nf_flowtable *flowtable, + struct list_head *block_cb_list) + { + struct flow_cls_offload cls_flow = {}; ++ struct netlink_ext_ack extack = {}; + struct flow_block_cb *block_cb; +- struct netlink_ext_ack extack; + __be16 proto = ETH_P_ALL; + int err, i = 0; + +-- +2.43.0 + diff --git a/queue-5.10/netfilter-nf_defrag_ipv6-use-net_generic-infra.patch b/queue-5.10/netfilter-nf_defrag_ipv6-use-net_generic-infra.patch new file mode 100644 index 00000000000..3204e502b2d --- /dev/null +++ b/queue-5.10/netfilter-nf_defrag_ipv6-use-net_generic-infra.patch @@ -0,0 +1,264 @@ +From 862bc61697b69b021572388af4cb114aba0a4838 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Apr 2021 16:11:07 +0200 +Subject: netfilter: nf_defrag_ipv6: use net_generic infra + +From: Florian Westphal + +[ Upstream commit 8b0adbe3e38dbe5aae9edf6f5159ffdca7cfbdf1 ] + +This allows followup patch to remove these members from struct net. + +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Stable-dep-of: 3cd740b98596 ("netfilter: allow ipv6 fragments to arrive on different devices") +Signed-off-by: Sasha Levin +--- + include/net/netfilter/ipv6/nf_defrag_ipv6.h | 6 ++ + net/ipv6/netfilter/nf_conntrack_reasm.c | 68 +++++++++++---------- + net/ipv6/netfilter/nf_defrag_ipv6_hooks.c | 15 +++-- + 3 files changed, 52 insertions(+), 37 deletions(-) + +diff --git a/include/net/netfilter/ipv6/nf_defrag_ipv6.h b/include/net/netfilter/ipv6/nf_defrag_ipv6.h +index 6d31cd0411434..ece923e2035b5 100644 +--- a/include/net/netfilter/ipv6/nf_defrag_ipv6.h ++++ b/include/net/netfilter/ipv6/nf_defrag_ipv6.h +@@ -13,4 +13,10 @@ int nf_ct_frag6_gather(struct net *net, struct sk_buff *skb, u32 user); + + struct inet_frags_ctl; + ++struct nft_ct_frag6_pernet { ++ struct ctl_table_header *nf_frag_frags_hdr; ++ struct fqdir *fqdir; ++ unsigned int users; ++}; ++ + #endif /* _NF_DEFRAG_IPV6_H */ +diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c +index c129ad334eb39..a0108415275fe 100644 +--- a/net/ipv6/netfilter/nf_conntrack_reasm.c ++++ b/net/ipv6/netfilter/nf_conntrack_reasm.c +@@ -15,28 +15,13 @@ + #include + #include + #include +-#include +-#include +-#include + #include +-#include + #include +-#include + #include +-#include +-#include + #include + +-#include +-#include + #include + +-#include +-#include +-#include +-#include +-#include +-#include + #include + #include + #include +@@ -44,11 +29,18 @@ + #include + #include + #include ++#include + + static const char nf_frags_cache_name[] = "nf-frags"; + ++unsigned int nf_frag_pernet_id __read_mostly; + static struct inet_frags nf_frags; + ++static struct nft_ct_frag6_pernet *nf_frag_pernet(struct net *net) ++{ ++ return net_generic(net, nf_frag_pernet_id); ++} ++ + #ifdef CONFIG_SYSCTL + + static struct ctl_table nf_ct_frag6_sysctl_table[] = { +@@ -75,6 +67,7 @@ static struct ctl_table nf_ct_frag6_sysctl_table[] = { + + static int nf_ct_frag6_sysctl_register(struct net *net) + { ++ struct nft_ct_frag6_pernet *nf_frag; + struct ctl_table *table; + struct ctl_table_header *hdr; + +@@ -86,18 +79,20 @@ static int nf_ct_frag6_sysctl_register(struct net *net) + goto err_alloc; + } + +- table[0].data = &net->nf_frag.fqdir->timeout; +- table[1].data = &net->nf_frag.fqdir->low_thresh; +- table[1].extra2 = &net->nf_frag.fqdir->high_thresh; +- table[2].data = &net->nf_frag.fqdir->high_thresh; +- table[2].extra1 = &net->nf_frag.fqdir->low_thresh; +- table[2].extra2 = &init_net.nf_frag.fqdir->high_thresh; ++ nf_frag = nf_frag_pernet(net); ++ ++ table[0].data = &nf_frag->fqdir->timeout; ++ table[1].data = &nf_frag->fqdir->low_thresh; ++ table[1].extra2 = &nf_frag->fqdir->high_thresh; ++ table[2].data = &nf_frag->fqdir->high_thresh; ++ table[2].extra1 = &nf_frag->fqdir->low_thresh; ++ table[2].extra2 = &nf_frag->fqdir->high_thresh; + + hdr = register_net_sysctl(net, "net/netfilter", table); + if (hdr == NULL) + goto err_reg; + +- net->nf_frag_frags_hdr = hdr; ++ nf_frag->nf_frag_frags_hdr = hdr; + return 0; + + err_reg: +@@ -109,10 +104,11 @@ static int nf_ct_frag6_sysctl_register(struct net *net) + + static void __net_exit nf_ct_frags6_sysctl_unregister(struct net *net) + { ++ struct nft_ct_frag6_pernet *nf_frag = nf_frag_pernet(net); + struct ctl_table *table; + +- table = net->nf_frag_frags_hdr->ctl_table_arg; +- unregister_net_sysctl_table(net->nf_frag_frags_hdr); ++ table = nf_frag->nf_frag_frags_hdr->ctl_table_arg; ++ unregister_net_sysctl_table(nf_frag->nf_frag_frags_hdr); + if (!net_eq(net, &init_net)) + kfree(table); + } +@@ -149,6 +145,7 @@ static void nf_ct_frag6_expire(struct timer_list *t) + static struct frag_queue *fq_find(struct net *net, __be32 id, u32 user, + const struct ipv6hdr *hdr, int iif) + { ++ struct nft_ct_frag6_pernet *nf_frag = nf_frag_pernet(net); + struct frag_v6_compare_key key = { + .id = id, + .saddr = hdr->saddr, +@@ -158,7 +155,7 @@ static struct frag_queue *fq_find(struct net *net, __be32 id, u32 user, + }; + struct inet_frag_queue *q; + +- q = inet_frag_find(net->nf_frag.fqdir, &key); ++ q = inet_frag_find(nf_frag->fqdir, &key); + if (!q) + return NULL; + +@@ -495,37 +492,44 @@ EXPORT_SYMBOL_GPL(nf_ct_frag6_gather); + + static int nf_ct_net_init(struct net *net) + { ++ struct nft_ct_frag6_pernet *nf_frag = nf_frag_pernet(net); + int res; + +- res = fqdir_init(&net->nf_frag.fqdir, &nf_frags, net); ++ res = fqdir_init(&nf_frag->fqdir, &nf_frags, net); + if (res < 0) + return res; + +- net->nf_frag.fqdir->high_thresh = IPV6_FRAG_HIGH_THRESH; +- net->nf_frag.fqdir->low_thresh = IPV6_FRAG_LOW_THRESH; +- net->nf_frag.fqdir->timeout = IPV6_FRAG_TIMEOUT; ++ nf_frag->fqdir->high_thresh = IPV6_FRAG_HIGH_THRESH; ++ nf_frag->fqdir->low_thresh = IPV6_FRAG_LOW_THRESH; ++ nf_frag->fqdir->timeout = IPV6_FRAG_TIMEOUT; + + res = nf_ct_frag6_sysctl_register(net); + if (res < 0) +- fqdir_exit(net->nf_frag.fqdir); ++ fqdir_exit(nf_frag->fqdir); + return res; + } + + static void nf_ct_net_pre_exit(struct net *net) + { +- fqdir_pre_exit(net->nf_frag.fqdir); ++ struct nft_ct_frag6_pernet *nf_frag = nf_frag_pernet(net); ++ ++ fqdir_pre_exit(nf_frag->fqdir); + } + + static void nf_ct_net_exit(struct net *net) + { ++ struct nft_ct_frag6_pernet *nf_frag = nf_frag_pernet(net); ++ + nf_ct_frags6_sysctl_unregister(net); +- fqdir_exit(net->nf_frag.fqdir); ++ fqdir_exit(nf_frag->fqdir); + } + + static struct pernet_operations nf_ct_net_ops = { + .init = nf_ct_net_init, + .pre_exit = nf_ct_net_pre_exit, + .exit = nf_ct_net_exit, ++ .id = &nf_frag_pernet_id, ++ .size = sizeof(struct nft_ct_frag6_pernet), + }; + + static const struct rhashtable_params nfct_rhash_params = { +diff --git a/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c b/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c +index 6646a87fb5dc1..402dc4ca9504f 100644 +--- a/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c ++++ b/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c +@@ -25,6 +25,8 @@ + #include + #include + ++extern unsigned int nf_frag_pernet_id; ++ + static DEFINE_MUTEX(defrag6_mutex); + + static enum ip6_defrag_users nf_ct6_defrag_user(unsigned int hooknum, +@@ -89,10 +91,12 @@ static const struct nf_hook_ops ipv6_defrag_ops[] = { + + static void __net_exit defrag6_net_exit(struct net *net) + { +- if (net->nf.defrag_ipv6) { ++ struct nft_ct_frag6_pernet *nf_frag = net_generic(net, nf_frag_pernet_id); ++ ++ if (nf_frag->users) { + nf_unregister_net_hooks(net, ipv6_defrag_ops, + ARRAY_SIZE(ipv6_defrag_ops)); +- net->nf.defrag_ipv6 = false; ++ nf_frag->users = 0; + } + } + +@@ -130,21 +134,22 @@ static void __exit nf_defrag_fini(void) + + int nf_defrag_ipv6_enable(struct net *net) + { ++ struct nft_ct_frag6_pernet *nf_frag = net_generic(net, nf_frag_pernet_id); + int err = 0; + + might_sleep(); + +- if (net->nf.defrag_ipv6) ++ if (nf_frag->users) + return 0; + + mutex_lock(&defrag6_mutex); +- if (net->nf.defrag_ipv6) ++ if (nf_frag->users) + goto out_unlock; + + err = nf_register_net_hooks(net, ipv6_defrag_ops, + ARRAY_SIZE(ipv6_defrag_ops)); + if (err == 0) +- net->nf.defrag_ipv6 = true; ++ nf_frag->users = 1; + + out_unlock: + mutex_unlock(&defrag6_mutex); +-- +2.43.0 + diff --git a/queue-5.10/s390-uv-panic-for-set-and-remove-shared-access-uvc-e.patch b/queue-5.10/s390-uv-panic-for-set-and-remove-shared-access-uvc-e.patch new file mode 100644 index 00000000000..d42c984ad2c --- /dev/null +++ b/queue-5.10/s390-uv-panic-for-set-and-remove-shared-access-uvc-e.patch @@ -0,0 +1,60 @@ +From 42160814e6e8270a17b8655ef323245d6fc53804 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Aug 2024 13:25:48 +0200 +Subject: s390/uv: Panic for set and remove shared access UVC errors + +From: Claudio Imbrenda + +[ Upstream commit cff59d8631e1409ffdd22d9d717e15810181b32c ] + +The return value uv_set_shared() and uv_remove_shared() (which are +wrappers around the share() function) is not always checked. The system +integrity of a protected guest depends on the Share and Unshare UVCs +being successful. This means that any caller that fails to check the +return value will compromise the security of the protected guest. + +No code path that would lead to such violation of the security +guarantees is currently exercised, since all the areas that are shared +never get unshared during the lifetime of the system. This might +change and become an issue in the future. + +The Share and Unshare UVCs can only fail in case of hypervisor +misbehaviour (either a bug or malicious behaviour). In such cases there +is no reasonable way forward, and the system needs to panic. + +This patch replaces the return at the end of the share() function with +a panic, to guarantee system integrity. + +Fixes: 5abb9351dfd9 ("s390/uv: introduce guest side ultravisor code") +Signed-off-by: Claudio Imbrenda +Reviewed-by: Christian Borntraeger +Reviewed-by: Steffen Eiden +Reviewed-by: Janosch Frank +Link: https://lore.kernel.org/r/20240801112548.85303-1-imbrenda@linux.ibm.com +Message-ID: <20240801112548.85303-1-imbrenda@linux.ibm.com> +[frankja@linux.ibm.com: Fixed up patch subject] +Signed-off-by: Janosch Frank +Signed-off-by: Sasha Levin +--- + arch/s390/include/asm/uv.h | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/arch/s390/include/asm/uv.h b/arch/s390/include/asm/uv.h +index 12c5f006c1364..8fd441150a4e6 100644 +--- a/arch/s390/include/asm/uv.h ++++ b/arch/s390/include/asm/uv.h +@@ -312,7 +312,10 @@ static inline int share(unsigned long addr, u16 cmd) + + if (!uv_call(0, (u64)&uvcb)) + return 0; +- return -EINVAL; ++ pr_err("%s UVC failed (rc: 0x%x, rrc: 0x%x), possible hypervisor bug.\n", ++ uvcb.header.cmd == UVC_CMD_SET_SHARED_ACCESS ? "Share" : "Unshare", ++ uvcb.header.rc, uvcb.header.rrc); ++ panic("System security cannot be guaranteed unless the system panics now.\n"); + } + + /* +-- +2.43.0 + diff --git a/queue-5.10/series b/queue-5.10/series index def5a781bd4..1e04cdd2041 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -16,3 +16,18 @@ memcg_write_event_control-fix-a-user-triggerable-oops.patch drm-amdgpu-jpeg2-properly-set-atomics-vmid-field.patch s390-cio-rename-bitmap_size-idset_bitmap_size.patch btrfs-rename-bitmap_set_bits-btrfs_bitmap_set_bits.patch +s390-uv-panic-for-set-and-remove-shared-access-uvc-e.patch +net-mlx5e-correctly-report-errors-for-ethtool-rx-flo.patch +atm-idt77252-prevent-use-after-free-in-dequeue_rx.patch +net-axienet-fix-register-defines-comment-description.patch +net-dsa-vsc73xx-pass-value-in-phy_write-operation.patch +net-dsa-vsc73xx-use-read_poll_timeout-instead-delay-.patch +net-dsa-vsc73xx-check-busy-flag-in-mdio-operations.patch +mptcp-correct-mptcp_subflow_attr_ssn_offset-reserved.patch +netfilter-nf_defrag_ipv6-use-net_generic-infra.patch +netfilter-allow-ipv6-fragments-to-arrive-on-differen.patch +netfilter-flowtable-initialise-extack-before-use.patch +net-hns3-fix-wrong-use-of-semaphore-up.patch +net-hns3-fix-a-deadlock-problem-when-config-tc-durin.patch +alsa-hda-realtek-fix-noise-from-speakers-on-lenovo-i.patch +fixup-net-dsa-microchip-fix-initial-port-flush-probl.patch