From: Greg Kroah-Hartman Date: Sun, 10 Jan 2021 10:57:43 +0000 (+0100) Subject: 5.4-stable patches X-Git-Tag: v4.4.251~49 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=9a8263b7e112c0788371e06ab09eb68264b4410f;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: atm-idt77252-call-pci_disable_device-on-error-path.patch cdc-ncm-remove-connected-log-message.patch erspan-fix-version-1-check-in-gre_parse_header.patch ethernet-ucc_geth-fix-use-after-free-in-ucc_geth_remove.patch ethernet-ucc_geth-set-dev-max_mtu-to-1518.patch i40e-fix-error-i40e_aq_rc_einval-when-removing-vfs.patch iavf-fix-double-release-of-rtnl_lock.patch ibmvnic-continue-fatal-error-reset-after-passive-init.patch ionic-account-for-vlan-tag-len-in-rx-buffer-len.patch ipv4-ignore-ecn-bits-for-fib-lookups-in-fib_compute_spec_dst.patch net-dcb-validate-netlink-message-in-dcb-handler.patch net-dsa-lantiq_gswip-enable-gswip_mii_cfg_en-also-for-internal-phys.patch net-dsa-lantiq_gswip-fix-gswip_mii_cfg-p-register-access.patch net-ethernet-fix-memleak-in-ethoc_probe.patch net-ethernet-mvneta-fix-error-handling-in-mvneta_probe.patch net-ethernet-ti-cpts-fix-ethtool-output-when-no-ptp_clock-registered.patch net-hdlc_ppp-fix-issues-when-mod_timer-is-called-while-timer-is-running.patch net-hns-fix-return-value-check-in-__lb_other_process.patch net-mvpp2-add-tcam-entry-to-drop-flow-control-pause-frames.patch net-mvpp2-fix-gop-port-3-networking-complex-control-configurations.patch net-mvpp2-fix-pkt-coalescing-int-threshold-configuration.patch net-mvpp2-prs-fix-pppoe-with-ipv6-packet-parse.patch net-ncsi-use-real-net-device-for-response-handler.patch net-sched-prevent-invalid-scell_log-shift-count.patch net-sched-sch_taprio-ensure-to-reset-destroy-all-child-qdiscs.patch net-sysfs-take-the-rtnl-lock-when-accessing-xps_cpus_map-and-num_tc.patch net-sysfs-take-the-rtnl-lock-when-accessing-xps_rxqs_map-and-num_tc.patch net-sysfs-take-the-rtnl-lock-when-storing-xps_cpus.patch net-sysfs-take-the-rtnl-lock-when-storing-xps_rxqs.patch net-systemport-set-dev-max_mtu-to-umac_max_mtu_size.patch net-usb-qmi_wwan-add-quectel-em160r-gl.patch qede-fix-offload-for-ipip-tunnel-packets.patch r8169-work-around-power-saving-bug-on-some-chip-versions.patch tun-fix-return-value-when-the-number-of-iovs-exceeds-max_skb_frags.patch vhost_net-fix-ubuf-refcount-incorrectly-when-sendmsg-fails.patch virtio_net-fix-recursive-call-to-cpus_read_lock.patch --- diff --git a/queue-5.4/atm-idt77252-call-pci_disable_device-on-error-path.patch b/queue-5.4/atm-idt77252-call-pci_disable_device-on-error-path.patch new file mode 100644 index 00000000000..f15597b1270 --- /dev/null +++ b/queue-5.4/atm-idt77252-call-pci_disable_device-on-error-path.patch @@ -0,0 +1,31 @@ +From foo@baz Sun Jan 10 11:49:07 AM CET 2021 +From: Dan Carpenter +Date: Sat, 19 Dec 2020 14:01:44 +0300 +Subject: atm: idt77252: call pci_disable_device() on error path + +From: Dan Carpenter + +[ Upstream commit 8df66af5c1e5f80562fe728db5ec069b21810144 ] + +This error path needs to disable the pci device before returning. + +Fixes: ede58ef28e10 ("atm: remove deprecated use of pci api") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/X93dmC4NX0vbTpGp@mwanda +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/atm/idt77252.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/atm/idt77252.c ++++ b/drivers/atm/idt77252.c +@@ -3606,7 +3606,7 @@ static int idt77252_init_one(struct pci_ + + if ((err = dma_set_mask_and_coherent(&pcidev->dev, DMA_BIT_MASK(32)))) { + printk("idt77252: can't enable DMA for PCI device at %s\n", pci_name(pcidev)); +- return err; ++ goto err_out_disable_pdev; + } + + card = kzalloc(sizeof(struct idt77252_dev), GFP_KERNEL); diff --git a/queue-5.4/cdc-ncm-remove-connected-log-message.patch b/queue-5.4/cdc-ncm-remove-connected-log-message.patch new file mode 100644 index 00000000000..def0129b85e --- /dev/null +++ b/queue-5.4/cdc-ncm-remove-connected-log-message.patch @@ -0,0 +1,41 @@ +From foo@baz Sun Jan 10 11:49:07 AM CET 2021 +From: Roland Dreier +Date: Wed, 23 Dec 2020 19:21:16 -0800 +Subject: CDC-NCM: remove "connected" log message + +From: Roland Dreier + +[ Upstream commit 59b4a8fa27f5a895582ada1ae5034af7c94a57b5 ] + +The cdc_ncm driver passes network connection notifications up to +usbnet_link_change(), which is the right place for any logging. +Remove the netdev_info() duplicating this from the driver itself. + +This stops devices such as my "TRENDnet USB 10/100/1G/2.5G LAN" +(ID 20f4:e02b) adapter from spamming the kernel log with + + cdc_ncm 2-2:2.0 enp0s2u2c2: network connection: connected + +messages every 60 msec or so. + +Signed-off-by: Roland Dreier +Reviewed-by: Greg Kroah-Hartman +Link: https://lore.kernel.org/r/20201224032116.2453938-1-roland@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/usb/cdc_ncm.c | 3 --- + 1 file changed, 3 deletions(-) + +--- a/drivers/net/usb/cdc_ncm.c ++++ b/drivers/net/usb/cdc_ncm.c +@@ -1625,9 +1625,6 @@ static void cdc_ncm_status(struct usbnet + * USB_CDC_NOTIFY_NETWORK_CONNECTION notification shall be + * sent by device after USB_CDC_NOTIFY_SPEED_CHANGE. + */ +- netif_info(dev, link, dev->net, +- "network connection: %sconnected\n", +- !!event->wValue ? "" : "dis"); + usbnet_link_change(dev, !!event->wValue, 0); + break; + diff --git a/queue-5.4/erspan-fix-version-1-check-in-gre_parse_header.patch b/queue-5.4/erspan-fix-version-1-check-in-gre_parse_header.patch new file mode 100644 index 00000000000..5ed3e40e94a --- /dev/null +++ b/queue-5.4/erspan-fix-version-1-check-in-gre_parse_header.patch @@ -0,0 +1,37 @@ +From foo@baz Sun Jan 10 11:49:07 AM CET 2021 +From: Cong Wang +Date: Sat, 26 Dec 2020 15:44:53 -0800 +Subject: erspan: fix version 1 check in gre_parse_header() + +From: Cong Wang + +[ Upstream commit 085c7c4e1c0e50d90b7d90f61a12e12b317a91e2 ] + +Both version 0 and version 1 use ETH_P_ERSPAN, but version 0 does not +have an erspan header. So the check in gre_parse_header() is wrong, +we have to distinguish version 1 from version 0. + +We can just check the gre header length like is_erspan_type1(). + +Fixes: cb73ee40b1b3 ("net: ip_gre: use erspan key field for tunnel lookup") +Reported-by: syzbot+f583ce3d4ddf9836b27a@syzkaller.appspotmail.com +Cc: William Tu +Cc: Lorenzo Bianconi +Signed-off-by: Cong Wang +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/gre_demux.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/ipv4/gre_demux.c ++++ b/net/ipv4/gre_demux.c +@@ -128,7 +128,7 @@ int gre_parse_header(struct sk_buff *skb + * to 0 and sets the configured key in the + * inner erspan header field + */ +- if (greh->protocol == htons(ETH_P_ERSPAN) || ++ if ((greh->protocol == htons(ETH_P_ERSPAN) && hdr_len != 4) || + greh->protocol == htons(ETH_P_ERSPAN2)) { + struct erspan_base_hdr *ershdr; + diff --git a/queue-5.4/ethernet-ucc_geth-fix-use-after-free-in-ucc_geth_remove.patch b/queue-5.4/ethernet-ucc_geth-fix-use-after-free-in-ucc_geth_remove.patch new file mode 100644 index 00000000000..8d6cf1398e6 --- /dev/null +++ b/queue-5.4/ethernet-ucc_geth-fix-use-after-free-in-ucc_geth_remove.patch @@ -0,0 +1,37 @@ +From foo@baz Sun Jan 10 11:49:07 AM CET 2021 +From: Rasmus Villemoes +Date: Fri, 18 Dec 2020 11:55:38 +0100 +Subject: ethernet: ucc_geth: fix use-after-free in ucc_geth_remove() + +From: Rasmus Villemoes + +[ Upstream commit e925e0cd2a705aaacb0b907bb3691fcac3a973a4 ] + +ugeth is the netdiv_priv() part of the netdevice. Accessing the memory +pointed to by ugeth (such as done by ucc_geth_memclean() and the two +of_node_puts) after free_netdev() is thus use-after-free. + +Fixes: 80a9fad8e89a ("ucc_geth: fix module removal") +Signed-off-by: Rasmus Villemoes +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/freescale/ucc_geth.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/freescale/ucc_geth.c ++++ b/drivers/net/ethernet/freescale/ucc_geth.c +@@ -3935,12 +3935,12 @@ static int ucc_geth_remove(struct platfo + struct device_node *np = ofdev->dev.of_node; + + unregister_netdev(dev); +- free_netdev(dev); + ucc_geth_memclean(ugeth); + if (of_phy_is_fixed_link(np)) + of_phy_deregister_fixed_link(np); + of_node_put(ugeth->ug_info->tbi_node); + of_node_put(ugeth->ug_info->phy_node); ++ free_netdev(dev); + + return 0; + } diff --git a/queue-5.4/ethernet-ucc_geth-set-dev-max_mtu-to-1518.patch b/queue-5.4/ethernet-ucc_geth-set-dev-max_mtu-to-1518.patch new file mode 100644 index 00000000000..79f72f6c04f --- /dev/null +++ b/queue-5.4/ethernet-ucc_geth-set-dev-max_mtu-to-1518.patch @@ -0,0 +1,46 @@ +From foo@baz Sun Jan 10 11:49:07 AM CET 2021 +From: Rasmus Villemoes +Date: Fri, 18 Dec 2020 11:55:36 +0100 +Subject: ethernet: ucc_geth: set dev->max_mtu to 1518 + +From: Rasmus Villemoes + +[ Upstream commit 1385ae5c30f238f81bc6528d897c6d7a0816783f ] + +All the buffers and registers are already set up appropriately for an +MTU slightly above 1500, so we just need to expose this to the +networking stack. AFAICT, there's no need to implement .ndo_change_mtu +when the receive buffers are always set up to support the max_mtu. + +This fixes several warnings during boot on our mpc8309-board with an +embedded mv88e6250 switch: + +mv88e6085 mdio@e0102120:10: nonfatal error -34 setting MTU 1500 on port 0 +... +mv88e6085 mdio@e0102120:10: nonfatal error -34 setting MTU 1500 on port 4 +ucc_geth e0102000.ethernet eth1: error -22 setting MTU to 1504 to include DSA overhead + +The last line explains what the DSA stack tries to do: achieving an MTU +of 1500 on-the-wire requires that the master netdevice connected to +the CPU port supports an MTU of 1500+the tagging overhead. + +Fixes: bfcb813203e6 ("net: dsa: configure the MTU for switch ports") +Reviewed-by: Andrew Lunn +Signed-off-by: Rasmus Villemoes +Reviewed-by: Vladimir Oltean +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/freescale/ucc_geth.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/ethernet/freescale/ucc_geth.c ++++ b/drivers/net/ethernet/freescale/ucc_geth.c +@@ -3890,6 +3890,7 @@ static int ucc_geth_probe(struct platfor + INIT_WORK(&ugeth->timeout_work, ucc_geth_timeout_work); + netif_napi_add(dev, &ugeth->napi, ucc_geth_poll, 64); + dev->mtu = 1500; ++ dev->max_mtu = 1518; + + ugeth->msg_enable = netif_msg_init(debug.msg_enable, UGETH_MSG_DEFAULT); + ugeth->phy_interface = phy_interface; diff --git a/queue-5.4/i40e-fix-error-i40e_aq_rc_einval-when-removing-vfs.patch b/queue-5.4/i40e-fix-error-i40e_aq_rc_einval-when-removing-vfs.patch new file mode 100644 index 00000000000..69be279ed54 --- /dev/null +++ b/queue-5.4/i40e-fix-error-i40e_aq_rc_einval-when-removing-vfs.patch @@ -0,0 +1,91 @@ +From foo@baz Sun Jan 10 11:49:07 AM CET 2021 +From: Sylwester Dziedziuch +Date: Thu, 22 Oct 2020 12:39:36 +0200 +Subject: i40e: Fix Error I40E_AQ_RC_EINVAL when removing VFs + +From: Sylwester Dziedziuch + +[ Upstream commit 3ac874fa84d1baaf0c0175f2a1499f5d88d528b2 ] + +When removing VFs for PF added to bridge there was +an error I40E_AQ_RC_EINVAL. It was caused by not properly +resetting and reinitializing PF when adding/removing VFs. +Changed how reset is performed when adding/removing VFs +to properly reinitialize PFs VSI. + +Fixes: fc60861e9b00 ("i40e: start up in VEPA mode by default") +Signed-off-by: Sylwester Dziedziuch +Tested-by: Konrad Jankowski +Signed-off-by: Tony Nguyen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/i40e/i40e.h | 3 +++ + drivers/net/ethernet/intel/i40e/i40e_main.c | 10 ++++++++++ + drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 4 ++-- + 3 files changed, 15 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/intel/i40e/i40e.h ++++ b/drivers/net/ethernet/intel/i40e/i40e.h +@@ -129,6 +129,7 @@ enum i40e_state_t { + __I40E_RESET_INTR_RECEIVED, + __I40E_REINIT_REQUESTED, + __I40E_PF_RESET_REQUESTED, ++ __I40E_PF_RESET_AND_REBUILD_REQUESTED, + __I40E_CORE_RESET_REQUESTED, + __I40E_GLOBAL_RESET_REQUESTED, + __I40E_EMP_RESET_INTR_RECEIVED, +@@ -156,6 +157,8 @@ enum i40e_state_t { + }; + + #define I40E_PF_RESET_FLAG BIT_ULL(__I40E_PF_RESET_REQUESTED) ++#define I40E_PF_RESET_AND_REBUILD_FLAG \ ++ BIT_ULL(__I40E_PF_RESET_AND_REBUILD_REQUESTED) + + /* VSI state flags */ + enum i40e_vsi_state_t { +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -44,6 +44,8 @@ static int i40e_setup_misc_vector(struct + static void i40e_determine_queue_usage(struct i40e_pf *pf); + static int i40e_setup_pf_filter_control(struct i40e_pf *pf); + static void i40e_prep_for_reset(struct i40e_pf *pf, bool lock_acquired); ++static void i40e_reset_and_rebuild(struct i40e_pf *pf, bool reinit, ++ bool lock_acquired); + static int i40e_reset(struct i40e_pf *pf); + static void i40e_rebuild(struct i40e_pf *pf, bool reinit, bool lock_acquired); + static int i40e_setup_misc_vector_for_recovery_mode(struct i40e_pf *pf); +@@ -8484,6 +8486,14 @@ void i40e_do_reset(struct i40e_pf *pf, u + "FW LLDP is disabled\n" : + "FW LLDP is enabled\n"); + ++ } else if (reset_flags & I40E_PF_RESET_AND_REBUILD_FLAG) { ++ /* Request a PF Reset ++ * ++ * Resets PF and reinitializes PFs VSI. ++ */ ++ i40e_prep_for_reset(pf, lock_acquired); ++ i40e_reset_and_rebuild(pf, true, lock_acquired); ++ + } else if (reset_flags & BIT_ULL(__I40E_REINIT_REQUESTED)) { + int v; + +--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +@@ -1704,7 +1704,7 @@ int i40e_pci_sriov_configure(struct pci_ + if (num_vfs) { + if (!(pf->flags & I40E_FLAG_VEB_MODE_ENABLED)) { + pf->flags |= I40E_FLAG_VEB_MODE_ENABLED; +- i40e_do_reset_safe(pf, I40E_PF_RESET_FLAG); ++ i40e_do_reset_safe(pf, I40E_PF_RESET_AND_REBUILD_FLAG); + } + ret = i40e_pci_sriov_enable(pdev, num_vfs); + goto sriov_configure_out; +@@ -1713,7 +1713,7 @@ int i40e_pci_sriov_configure(struct pci_ + if (!pci_vfs_assigned(pf->pdev)) { + i40e_free_vfs(pf); + pf->flags &= ~I40E_FLAG_VEB_MODE_ENABLED; +- i40e_do_reset_safe(pf, I40E_PF_RESET_FLAG); ++ i40e_do_reset_safe(pf, I40E_PF_RESET_AND_REBUILD_FLAG); + } else { + dev_warn(&pdev->dev, "Unable to free VFs because some are assigned to VMs.\n"); + ret = -EINVAL; diff --git a/queue-5.4/iavf-fix-double-release-of-rtnl_lock.patch b/queue-5.4/iavf-fix-double-release-of-rtnl_lock.patch new file mode 100644 index 00000000000..07bbe53d294 --- /dev/null +++ b/queue-5.4/iavf-fix-double-release-of-rtnl_lock.patch @@ -0,0 +1,37 @@ +From foo@baz Sun Jan 10 11:49:07 AM CET 2021 +From: Jakub Kicinski +Date: Wed, 2 Dec 2020 18:18:06 -0800 +Subject: iavf: fix double-release of rtnl_lock + +From: Jakub Kicinski + +[ Upstream commit f1340265726e0edf8a8cef28e665b28ad6302ce9 ] + +This code does not jump to exit on an error in iavf_lan_add_device(), +so the rtnl_unlock() from the normal path will follow. + +Fixes: b66c7bc1cd4d ("iavf: Refactor init state machine") +Signed-off-by: Jakub Kicinski +Reviewed-by: Tony Nguyen +Tested-by: Konrad Jankowski +Signed-off-by: Tony Nguyen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/iavf/iavf_main.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/drivers/net/ethernet/intel/iavf/iavf_main.c ++++ b/drivers/net/ethernet/intel/iavf/iavf_main.c +@@ -1844,11 +1844,9 @@ static int iavf_init_get_resources(struc + netif_tx_stop_all_queues(netdev); + if (CLIENT_ALLOWED(adapter)) { + err = iavf_lan_add_device(adapter); +- if (err) { +- rtnl_unlock(); ++ if (err) + dev_info(&pdev->dev, "Failed to add VF to client API service list: %d\n", + err); +- } + } + dev_info(&pdev->dev, "MAC address: %pM\n", adapter->hw.mac.addr); + if (netdev->features & NETIF_F_GRO) diff --git a/queue-5.4/ibmvnic-continue-fatal-error-reset-after-passive-init.patch b/queue-5.4/ibmvnic-continue-fatal-error-reset-after-passive-init.patch new file mode 100644 index 00000000000..639653884fb --- /dev/null +++ b/queue-5.4/ibmvnic-continue-fatal-error-reset-after-passive-init.patch @@ -0,0 +1,44 @@ +From foo@baz Sun Jan 10 11:49:07 AM CET 2021 +From: Lijun Pan +Date: Sat, 19 Dec 2020 15:40:34 -0600 +Subject: ibmvnic: continue fatal error reset after passive init + +From: Lijun Pan + +[ Upstream commit 1f45dc22066797479072978feeada0852502e180 ] + +Commit f9c6cea0b385 ("ibmvnic: Skip fatal error reset after passive init") +says "If the passive +CRQ initialization occurs before the FATAL reset task is processed, +the FATAL error reset task would try to access a CRQ message queue +that was freed, causing an oops. The problem may be most likely to +occur during DLPAR add vNIC with a non-default MTU, because the DLPAR +process will automatically issue a change MTU request. +Fix this by not processing fatal error reset if CRQ is passively +initialized after client-driven CRQ initialization fails." + +Even with this commit, we still see similar kernel crashes. In order +to completely solve this problem, we'd better continue the fatal error +reset, capture the kernel crash, and try to fix it from that end. + +Fixes: f9c6cea0b385 ("ibmvnic: Skip fatal error reset after passive init") +Signed-off-by: Lijun Pan +Link: https://lore.kernel.org/r/20201219214034.21123-1-ljp@linux.ibm.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/ibm/ibmvnic.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -2152,8 +2152,7 @@ static void __ibmvnic_reset(struct work_ + rc = do_hard_reset(adapter, rwi, reset_state); + rtnl_unlock(); + } +- } else if (!(rwi->reset_reason == VNIC_RESET_FATAL && +- adapter->from_passive_init)) { ++ } else { + rc = do_reset(adapter, rwi, reset_state); + } + kfree(rwi); diff --git a/queue-5.4/ionic-account-for-vlan-tag-len-in-rx-buffer-len.patch b/queue-5.4/ionic-account-for-vlan-tag-len-in-rx-buffer-len.patch new file mode 100644 index 00000000000..8d79e519627 --- /dev/null +++ b/queue-5.4/ionic-account-for-vlan-tag-len-in-rx-buffer-len.patch @@ -0,0 +1,32 @@ +From foo@baz Sun Jan 10 11:49:07 AM CET 2021 +From: Shannon Nelson +Date: Fri, 18 Dec 2020 13:50:01 -0800 +Subject: ionic: account for vlan tag len in rx buffer len + +From: Shannon Nelson + +[ Upstream commit 83469893204281ecf65d572bddf02de29a19787c ] + +Let the FW know we have enough receive buffer space for the +vlan tag if it isn't stripped. + +Fixes: 0f3154e6bcb3 ("ionic: Add Tx and Rx handling") +Signed-off-by: Shannon Nelson +Link: https://lore.kernel.org/r/20201218215001.64696-1-snelson@pensando.io +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/pensando/ionic/ionic_txrx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/pensando/ionic/ionic_txrx.c ++++ b/drivers/net/ethernet/pensando/ionic/ionic_txrx.c +@@ -257,7 +257,7 @@ void ionic_rx_fill(struct ionic_queue *q + unsigned int len; + unsigned int i; + +- len = netdev->mtu + ETH_HLEN; ++ len = netdev->mtu + ETH_HLEN + VLAN_HLEN; + + for (i = ionic_q_space_avail(q); i; i--) { + skb = ionic_rx_skb_alloc(q, len, &dma_addr); diff --git a/queue-5.4/ipv4-ignore-ecn-bits-for-fib-lookups-in-fib_compute_spec_dst.patch b/queue-5.4/ipv4-ignore-ecn-bits-for-fib-lookups-in-fib_compute_spec_dst.patch new file mode 100644 index 00000000000..8657f54c29e --- /dev/null +++ b/queue-5.4/ipv4-ignore-ecn-bits-for-fib-lookups-in-fib_compute_spec_dst.patch @@ -0,0 +1,69 @@ +From foo@baz Sun Jan 10 11:49:07 AM CET 2021 +From: Guillaume Nault +Date: Thu, 24 Dec 2020 20:01:09 +0100 +Subject: ipv4: Ignore ECN bits for fib lookups in fib_compute_spec_dst() + +From: Guillaume Nault + +[ Upstream commit 21fdca22eb7df2a1e194b8adb812ce370748b733 ] + +RT_TOS() only clears one of the ECN bits. Therefore, when +fib_compute_spec_dst() resorts to a fib lookup, it can return +different results depending on the value of the second ECN bit. + +For example, ECT(0) and ECT(1) packets could be treated differently. + + $ ip netns add ns0 + $ ip netns add ns1 + $ ip link add name veth01 netns ns0 type veth peer name veth10 netns ns1 + $ ip -netns ns0 link set dev lo up + $ ip -netns ns1 link set dev lo up + $ ip -netns ns0 link set dev veth01 up + $ ip -netns ns1 link set dev veth10 up + + $ ip -netns ns0 address add 192.0.2.10/24 dev veth01 + $ ip -netns ns1 address add 192.0.2.11/24 dev veth10 + + $ ip -netns ns1 address add 192.0.2.21/32 dev lo + $ ip -netns ns1 route add 192.0.2.10/32 tos 4 dev veth10 src 192.0.2.21 + $ ip netns exec ns1 sysctl -wq net.ipv4.icmp_echo_ignore_broadcasts=0 + +With TOS 4 and ECT(1), ns1 replies using source address 192.0.2.21 +(ping uses -Q to set all TOS and ECN bits): + + $ ip netns exec ns0 ping -c 1 -b -Q 5 192.0.2.255 + [...] + 64 bytes from 192.0.2.21: icmp_seq=1 ttl=64 time=0.544 ms + +But with TOS 4 and ECT(0), ns1 replies using source address 192.0.2.11 +because the "tos 4" route isn't matched: + + $ ip netns exec ns0 ping -c 1 -b -Q 6 192.0.2.255 + [...] + 64 bytes from 192.0.2.11: icmp_seq=1 ttl=64 time=0.597 ms + +After this patch the ECN bits don't affect the result anymore: + + $ ip netns exec ns0 ping -c 1 -b -Q 6 192.0.2.255 + [...] + 64 bytes from 192.0.2.21: icmp_seq=1 ttl=64 time=0.591 ms + +Fixes: 35ebf65e851c ("ipv4: Create and use fib_compute_spec_dst() helper.") +Signed-off-by: Guillaume Nault +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/fib_frontend.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/ipv4/fib_frontend.c ++++ b/net/ipv4/fib_frontend.c +@@ -302,7 +302,7 @@ __be32 fib_compute_spec_dst(struct sk_bu + .flowi4_iif = LOOPBACK_IFINDEX, + .flowi4_oif = l3mdev_master_ifindex_rcu(dev), + .daddr = ip_hdr(skb)->saddr, +- .flowi4_tos = RT_TOS(ip_hdr(skb)->tos), ++ .flowi4_tos = ip_hdr(skb)->tos & IPTOS_RT_MASK, + .flowi4_scope = scope, + .flowi4_mark = vmark ? skb->mark : 0, + }; diff --git a/queue-5.4/net-dcb-validate-netlink-message-in-dcb-handler.patch b/queue-5.4/net-dcb-validate-netlink-message-in-dcb-handler.patch new file mode 100644 index 00000000000..70d16f170e0 --- /dev/null +++ b/queue-5.4/net-dcb-validate-netlink-message-in-dcb-handler.patch @@ -0,0 +1,47 @@ +From foo@baz Sun Jan 10 11:49:07 AM CET 2021 +From: Petr Machata +Date: Tue, 22 Dec 2020 22:49:44 +0100 +Subject: net: dcb: Validate netlink message in DCB handler + +From: Petr Machata + +[ Upstream commit 826f328e2b7e8854dd42ea44e6519cd75018e7b1 ] + +DCB uses the same handler function for both RTM_GETDCB and RTM_SETDCB +messages. dcb_doit() bounces RTM_SETDCB mesasges if the user does not have +the CAP_NET_ADMIN capability. + +However, the operation to be performed is not decided from the DCB message +type, but from the DCB command. Thus DCB_CMD_*_GET commands are used for +reading DCB objects, the corresponding SET and DEL commands are used for +manipulation. + +The assumption is that set-like commands will be sent via an RTM_SETDCB +message, and get-like ones via RTM_GETDCB. However, this assumption is not +enforced. + +It is therefore possible to manipulate DCB objects without CAP_NET_ADMIN +capability by sending the corresponding command in an RTM_GETDCB message. +That is a bug. Fix it by validating the type of the request message against +the type used for the response. + +Fixes: 2f90b8657ec9 ("ixgbe: this patch adds support for DCB to the kernel and ixgbe driver") +Signed-off-by: Petr Machata +Link: https://lore.kernel.org/r/a2a9b88418f3a58ef211b718f2970128ef9e3793.1608673640.git.me@pmachata.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/dcb/dcbnl.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/net/dcb/dcbnl.c ++++ b/net/dcb/dcbnl.c +@@ -1765,6 +1765,8 @@ static int dcb_doit(struct sk_buff *skb, + fn = &reply_funcs[dcb->cmd]; + if (!fn->cb) + return -EOPNOTSUPP; ++ if (fn->type != nlh->nlmsg_type) ++ return -EPERM; + + if (!tb[DCB_ATTR_IFNAME]) + return -EINVAL; diff --git a/queue-5.4/net-dsa-lantiq_gswip-enable-gswip_mii_cfg_en-also-for-internal-phys.patch b/queue-5.4/net-dsa-lantiq_gswip-enable-gswip_mii_cfg_en-also-for-internal-phys.patch new file mode 100644 index 00000000000..61004e403d6 --- /dev/null +++ b/queue-5.4/net-dsa-lantiq_gswip-enable-gswip_mii_cfg_en-also-for-internal-phys.patch @@ -0,0 +1,37 @@ +From foo@baz Sun Jan 10 11:49:07 AM CET 2021 +From: Martin Blumenstingl +Date: Sun, 3 Jan 2021 02:25:43 +0100 +Subject: net: dsa: lantiq_gswip: Enable GSWIP_MII_CFG_EN also for internal PHYs + +From: Martin Blumenstingl + +[ Upstream commit c1a9ec7e5d577a9391660800c806c53287fca991 ] + +Enable GSWIP_MII_CFG_EN also for internal PHYs to make traffic flow. +Without this the PHY link is detected properly and ethtool statistics +for TX are increasing but there's no RX traffic coming in. + +Fixes: 14fceff4771e51 ("net: dsa: Add Lantiq / Intel DSA driver for vrx200") +Suggested-by: Hauke Mehrtens +Signed-off-by: Martin Blumenstingl +Acked-by: Hauke Mehrtens +Reviewed-by: Florian Fainelli +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/dsa/lantiq_gswip.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/drivers/net/dsa/lantiq_gswip.c ++++ b/drivers/net/dsa/lantiq_gswip.c +@@ -1522,9 +1522,7 @@ static void gswip_phylink_mac_link_up(st + { + struct gswip_priv *priv = ds->priv; + +- /* Enable the xMII interface only for the external PHY */ +- if (interface != PHY_INTERFACE_MODE_INTERNAL) +- gswip_mii_mask_cfg(priv, 0, GSWIP_MII_CFG_EN, port); ++ gswip_mii_mask_cfg(priv, 0, GSWIP_MII_CFG_EN, port); + } + + static void gswip_get_strings(struct dsa_switch *ds, int port, u32 stringset, diff --git a/queue-5.4/net-dsa-lantiq_gswip-fix-gswip_mii_cfg-p-register-access.patch b/queue-5.4/net-dsa-lantiq_gswip-fix-gswip_mii_cfg-p-register-access.patch new file mode 100644 index 00000000000..be980a26444 --- /dev/null +++ b/queue-5.4/net-dsa-lantiq_gswip-fix-gswip_mii_cfg-p-register-access.patch @@ -0,0 +1,78 @@ +From foo@baz Sun Jan 10 11:49:07 AM CET 2021 +From: Martin Blumenstingl +Date: Sun, 3 Jan 2021 02:25:44 +0100 +Subject: net: dsa: lantiq_gswip: Fix GSWIP_MII_CFG(p) register access + +From: Martin Blumenstingl + +[ Upstream commit 709a3c9dff2a639966ae7d8ba6239d2b8aba036d ] + +There is one GSWIP_MII_CFG register for each switch-port except the CPU +port. The register offset for the first port is 0x0, 0x02 for the +second, 0x04 for the third and so on. + +Update the driver to not only restrict the GSWIP_MII_CFG registers to +ports 0, 1 and 5. Handle ports 0..5 instead but skip the CPU port. This +means we are not overwriting the configuration for the third port (port +two since we start counting from zero) with the settings for the sixth +port (with number five) anymore. + +The GSWIP_MII_PCDU(p) registers are not updated because there's really +only three (one for each of the following ports: 0, 1, 5). + +Fixes: 14fceff4771e51 ("net: dsa: Add Lantiq / Intel DSA driver for vrx200") +Signed-off-by: Martin Blumenstingl +Acked-by: Hauke Mehrtens +Reviewed-by: Florian Fainelli +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/dsa/lantiq_gswip.c | 23 ++++++----------------- + 1 file changed, 6 insertions(+), 17 deletions(-) + +--- a/drivers/net/dsa/lantiq_gswip.c ++++ b/drivers/net/dsa/lantiq_gswip.c +@@ -92,9 +92,7 @@ + GSWIP_MDIO_PHY_FDUP_MASK) + + /* GSWIP MII Registers */ +-#define GSWIP_MII_CFG0 0x00 +-#define GSWIP_MII_CFG1 0x02 +-#define GSWIP_MII_CFG5 0x04 ++#define GSWIP_MII_CFGp(p) (0x2 * (p)) + #define GSWIP_MII_CFG_EN BIT(14) + #define GSWIP_MII_CFG_LDCLKDIS BIT(12) + #define GSWIP_MII_CFG_MODE_MIIP 0x0 +@@ -392,17 +390,9 @@ static void gswip_mii_mask(struct gswip_ + static void gswip_mii_mask_cfg(struct gswip_priv *priv, u32 clear, u32 set, + int port) + { +- switch (port) { +- case 0: +- gswip_mii_mask(priv, clear, set, GSWIP_MII_CFG0); +- break; +- case 1: +- gswip_mii_mask(priv, clear, set, GSWIP_MII_CFG1); +- break; +- case 5: +- gswip_mii_mask(priv, clear, set, GSWIP_MII_CFG5); +- break; +- } ++ /* There's no MII_CFG register for the CPU port */ ++ if (!dsa_is_cpu_port(priv->ds, port)) ++ gswip_mii_mask(priv, clear, set, GSWIP_MII_CFGp(port)); + } + + static void gswip_mii_mask_pcdu(struct gswip_priv *priv, u32 clear, u32 set, +@@ -806,9 +796,8 @@ static int gswip_setup(struct dsa_switch + gswip_mdio_mask(priv, 0xff, 0x09, GSWIP_MDIO_MDC_CFG1); + + /* Disable the xMII link */ +- gswip_mii_mask_cfg(priv, GSWIP_MII_CFG_EN, 0, 0); +- gswip_mii_mask_cfg(priv, GSWIP_MII_CFG_EN, 0, 1); +- gswip_mii_mask_cfg(priv, GSWIP_MII_CFG_EN, 0, 5); ++ for (i = 0; i < priv->hw_info->max_ports; i++) ++ gswip_mii_mask_cfg(priv, GSWIP_MII_CFG_EN, 0, i); + + /* enable special tag insertion on cpu port */ + gswip_switch_mask(priv, 0, GSWIP_FDMA_PCTRL_STEN, diff --git a/queue-5.4/net-ethernet-fix-memleak-in-ethoc_probe.patch b/queue-5.4/net-ethernet-fix-memleak-in-ethoc_probe.patch new file mode 100644 index 00000000000..97115ec8c9f --- /dev/null +++ b/queue-5.4/net-ethernet-fix-memleak-in-ethoc_probe.patch @@ -0,0 +1,42 @@ +From foo@baz Sun Jan 10 11:49:07 AM CET 2021 +From: Dinghao Liu +Date: Wed, 23 Dec 2020 19:06:12 +0800 +Subject: net: ethernet: Fix memleak in ethoc_probe + +From: Dinghao Liu + +[ Upstream commit 5d41f9b7ee7a5a5138894f58846a4ffed601498a ] + +When mdiobus_register() fails, priv->mdio allocated +by mdiobus_alloc() has not been freed, which leads +to memleak. + +Fixes: e7f4dc3536a4 ("mdio: Move allocation of interrupts into core") +Signed-off-by: Dinghao Liu +Reviewed-by: Andrew Lunn +Link: https://lore.kernel.org/r/20201223110615.31389-1-dinghao.liu@zju.edu.cn +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/ethoc.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/ethoc.c ++++ b/drivers/net/ethernet/ethoc.c +@@ -1207,7 +1207,7 @@ static int ethoc_probe(struct platform_d + ret = mdiobus_register(priv->mdio); + if (ret) { + dev_err(&netdev->dev, "failed to register MDIO bus\n"); +- goto free2; ++ goto free3; + } + + ret = ethoc_mdio_probe(netdev); +@@ -1239,6 +1239,7 @@ error2: + netif_napi_del(&priv->napi); + error: + mdiobus_unregister(priv->mdio); ++free3: + mdiobus_free(priv->mdio); + free2: + clk_disable_unprepare(priv->clk); diff --git a/queue-5.4/net-ethernet-mvneta-fix-error-handling-in-mvneta_probe.patch b/queue-5.4/net-ethernet-mvneta-fix-error-handling-in-mvneta_probe.patch new file mode 100644 index 00000000000..7ecc2003616 --- /dev/null +++ b/queue-5.4/net-ethernet-mvneta-fix-error-handling-in-mvneta_probe.patch @@ -0,0 +1,32 @@ +From foo@baz Sun Jan 10 11:49:07 AM CET 2021 +From: Dinghao Liu +Date: Sun, 20 Dec 2020 16:29:30 +0800 +Subject: net: ethernet: mvneta: Fix error handling in mvneta_probe + +From: Dinghao Liu + +[ Upstream commit 58f60329a6be35a5653edb3fd2023ccef9eb9943 ] + +When mvneta_port_power_up() fails, we should execute +cleanup functions after label err_netdev to avoid memleak. + +Fixes: 41c2b6b4f0f80 ("net: ethernet: mvneta: Add back interface mode validation") +Signed-off-by: Dinghao Liu +Link: https://lore.kernel.org/r/20201220082930.21623-1-dinghao.liu@zju.edu.cn +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/marvell/mvneta.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/marvell/mvneta.c ++++ b/drivers/net/ethernet/marvell/mvneta.c +@@ -4694,7 +4694,7 @@ static int mvneta_probe(struct platform_ + err = mvneta_port_power_up(pp, pp->phy_interface); + if (err < 0) { + dev_err(&pdev->dev, "can't power up port\n"); +- return err; ++ goto err_netdev; + } + + /* Armada3700 network controller does not support per-cpu diff --git a/queue-5.4/net-ethernet-ti-cpts-fix-ethtool-output-when-no-ptp_clock-registered.patch b/queue-5.4/net-ethernet-ti-cpts-fix-ethtool-output-when-no-ptp_clock-registered.patch new file mode 100644 index 00000000000..0a348b21638 --- /dev/null +++ b/queue-5.4/net-ethernet-ti-cpts-fix-ethtool-output-when-no-ptp_clock-registered.patch @@ -0,0 +1,46 @@ +From foo@baz Sun Jan 10 11:49:07 AM CET 2021 +From: Grygorii Strashko +Date: Thu, 24 Dec 2020 18:24:05 +0200 +Subject: net: ethernet: ti: cpts: fix ethtool output when no ptp_clock registered + +From: Grygorii Strashko + +[ Upstream commit 4614792eebcbf81c60ad3604c1aeeb2b0899cea4 ] + +The CPTS driver registers PTP PHC clock when first netif is going up and +unregister it when all netif are down. Now ethtool will show: + - PTP PHC clock index 0 after boot until first netif is up; + - the last assigned PTP PHC clock index even if PTP PHC clock is not +registered any more after all netifs are down. + +This patch ensures that -1 is returned by ethtool when PTP PHC clock is not +registered any more. + +Fixes: 8a2c9a5ab4b9 ("net: ethernet: ti: cpts: rework initialization/deinitialization") +Signed-off-by: Grygorii Strashko +Acked-by: Richard Cochran +Link: https://lore.kernel.org/r/20201224162405.28032-1-grygorii.strashko@ti.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/ti/cpts.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/net/ethernet/ti/cpts.c ++++ b/drivers/net/ethernet/ti/cpts.c +@@ -485,6 +485,7 @@ void cpts_unregister(struct cpts *cpts) + + ptp_clock_unregister(cpts->clock); + cpts->clock = NULL; ++ cpts->phc_index = -1; + + cpts_write32(cpts, 0, int_enable); + cpts_write32(cpts, 0, control); +@@ -667,6 +668,7 @@ struct cpts *cpts_create(struct device * + cpts->cc.read = cpts_systim_read; + cpts->cc.mask = CLOCKSOURCE_MASK(32); + cpts->info = cpts_info; ++ cpts->phc_index = -1; + + cpts_calc_mult_shift(cpts); + /* save cc.mult original value as it can be modified diff --git a/queue-5.4/net-hdlc_ppp-fix-issues-when-mod_timer-is-called-while-timer-is-running.patch b/queue-5.4/net-hdlc_ppp-fix-issues-when-mod_timer-is-called-while-timer-is-running.patch new file mode 100644 index 00000000000..edd02c9fc3b --- /dev/null +++ b/queue-5.4/net-hdlc_ppp-fix-issues-when-mod_timer-is-called-while-timer-is-running.patch @@ -0,0 +1,44 @@ +From foo@baz Sun Jan 10 11:49:07 AM CET 2021 +From: Xie He +Date: Sun, 27 Dec 2020 18:53:39 -0800 +Subject: net: hdlc_ppp: Fix issues when mod_timer is called while timer is running + +From: Xie He + +[ Upstream commit 1fef73597fa545c35fddc953979013882fbd4e55 ] + +ppp_cp_event is called directly or indirectly by ppp_rx with "ppp->lock" +held. It may call mod_timer to add a new timer. However, at the same time +ppp_timer may be already running and waiting for "ppp->lock". In this +case, there's no need for ppp_timer to continue running and it can just +exit. + +If we let ppp_timer continue running, it may call add_timer. This causes +kernel panic because add_timer can't be called with a timer pending. +This patch fixes this problem. + +Fixes: e022c2f07ae5 ("WAN: new synchronous PPP implementation for generic HDLC.") +Cc: Krzysztof Halasa +Signed-off-by: Xie He +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wan/hdlc_ppp.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/net/wan/hdlc_ppp.c ++++ b/drivers/net/wan/hdlc_ppp.c +@@ -569,6 +569,13 @@ static void ppp_timer(struct timer_list + unsigned long flags; + + spin_lock_irqsave(&ppp->lock, flags); ++ /* mod_timer could be called after we entered this function but ++ * before we got the lock. ++ */ ++ if (timer_pending(&proto->timer)) { ++ spin_unlock_irqrestore(&ppp->lock, flags); ++ return; ++ } + switch (proto->state) { + case STOPPING: + case REQ_SENT: diff --git a/queue-5.4/net-hns-fix-return-value-check-in-__lb_other_process.patch b/queue-5.4/net-hns-fix-return-value-check-in-__lb_other_process.patch new file mode 100644 index 00000000000..e9c50655561 --- /dev/null +++ b/queue-5.4/net-hns-fix-return-value-check-in-__lb_other_process.patch @@ -0,0 +1,33 @@ +From foo@baz Sun Jan 10 11:49:07 AM CET 2021 +From: Yunjian Wang +Date: Sat, 26 Dec 2020 16:10:05 +0800 +Subject: net: hns: fix return value check in __lb_other_process() + +From: Yunjian Wang + +[ Upstream commit 5ede3ada3da7f050519112b81badc058190b9f9f ] + +The function skb_copy() could return NULL, the return value +need to be checked. + +Fixes: b5996f11ea54 ("net: add Hisilicon Network Subsystem basic ethernet support") +Signed-off-by: Yunjian Wang +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/hisilicon/hns/hns_ethtool.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c ++++ b/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c +@@ -415,6 +415,10 @@ static void __lb_other_process(struct hn + /* for mutl buffer*/ + new_skb = skb_copy(skb, GFP_ATOMIC); + dev_kfree_skb_any(skb); ++ if (!new_skb) { ++ netdev_err(ndev, "skb alloc failed\n"); ++ return; ++ } + skb = new_skb; + + check_ok = 0; diff --git a/queue-5.4/net-mvpp2-add-tcam-entry-to-drop-flow-control-pause-frames.patch b/queue-5.4/net-mvpp2-add-tcam-entry-to-drop-flow-control-pause-frames.patch new file mode 100644 index 00000000000..2260e4375ca --- /dev/null +++ b/queue-5.4/net-mvpp2-add-tcam-entry-to-drop-flow-control-pause-frames.patch @@ -0,0 +1,89 @@ +From foo@baz Sun Jan 10 11:49:07 AM CET 2021 +From: Stefan Chulski +Date: Thu, 17 Dec 2020 20:30:17 +0200 +Subject: net: mvpp2: Add TCAM entry to drop flow control pause frames + +From: Stefan Chulski + +[ Upstream commit 3f48fab62bb81a7f9d01e9d43c40395fad011dd5 ] + +Issue: +Flow control frame used to pause GoP(MAC) was delivered to the CPU +and created a load on the CPU. Since XOFF/XON frames are used only +by MAC, these frames should be dropped inside MAC. + +Fix: +According to 802.3-2012 - IEEE Standard for Ethernet pause frame +has unique destination MAC address 01-80-C2-00-00-01. +Add TCAM parser entry to track and drop pause frames by destination MAC. + +Fixes: 3f518509dedc ("ethernet: Add new driver for Marvell Armada 375 network unit") +Signed-off-by: Stefan Chulski +Link: https://lore.kernel.org/r/1608229817-21951-1-git-send-email-stefanc@marvell.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c | 33 +++++++++++++++++++++++++ + drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.h | 2 - + 2 files changed, 34 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c ++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c +@@ -405,6 +405,38 @@ static int mvpp2_prs_tcam_first_free(str + return -EINVAL; + } + ++/* Drop flow control pause frames */ ++static void mvpp2_prs_drop_fc(struct mvpp2 *priv) ++{ ++ unsigned char da[ETH_ALEN] = { 0x01, 0x80, 0xC2, 0x00, 0x00, 0x01 }; ++ struct mvpp2_prs_entry pe; ++ unsigned int len; ++ ++ memset(&pe, 0, sizeof(pe)); ++ ++ /* For all ports - drop flow control frames */ ++ pe.index = MVPP2_PE_FC_DROP; ++ mvpp2_prs_tcam_lu_set(&pe, MVPP2_PRS_LU_MAC); ++ ++ /* Set match on DA */ ++ len = ETH_ALEN; ++ while (len--) ++ mvpp2_prs_tcam_data_byte_set(&pe, len, da[len], 0xff); ++ ++ mvpp2_prs_sram_ri_update(&pe, MVPP2_PRS_RI_DROP_MASK, ++ MVPP2_PRS_RI_DROP_MASK); ++ ++ mvpp2_prs_sram_bits_set(&pe, MVPP2_PRS_SRAM_LU_GEN_BIT, 1); ++ mvpp2_prs_sram_next_lu_set(&pe, MVPP2_PRS_LU_FLOWS); ++ ++ /* Mask all ports */ ++ mvpp2_prs_tcam_port_map_set(&pe, MVPP2_PRS_PORT_MASK); ++ ++ /* Update shadow table and hw entry */ ++ mvpp2_prs_shadow_set(priv, pe.index, MVPP2_PRS_LU_MAC); ++ mvpp2_prs_hw_write(priv, &pe); ++} ++ + /* Enable/disable dropping all mac da's */ + static void mvpp2_prs_mac_drop_all_set(struct mvpp2 *priv, int port, bool add) + { +@@ -1162,6 +1194,7 @@ static void mvpp2_prs_mac_init(struct mv + mvpp2_prs_hw_write(priv, &pe); + + /* Create dummy entries for drop all and promiscuous modes */ ++ mvpp2_prs_drop_fc(priv); + mvpp2_prs_mac_drop_all_set(priv, 0, false); + mvpp2_prs_mac_promisc_set(priv, 0, MVPP2_PRS_L2_UNI_CAST, false); + mvpp2_prs_mac_promisc_set(priv, 0, MVPP2_PRS_L2_MULTI_CAST, false); +--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.h ++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.h +@@ -129,7 +129,7 @@ + #define MVPP2_PE_VID_EDSA_FLTR_DEFAULT (MVPP2_PRS_TCAM_SRAM_SIZE - 7) + #define MVPP2_PE_VLAN_DBL (MVPP2_PRS_TCAM_SRAM_SIZE - 6) + #define MVPP2_PE_VLAN_NONE (MVPP2_PRS_TCAM_SRAM_SIZE - 5) +-/* reserved */ ++#define MVPP2_PE_FC_DROP (MVPP2_PRS_TCAM_SRAM_SIZE - 4) + #define MVPP2_PE_MAC_MC_PROMISCUOUS (MVPP2_PRS_TCAM_SRAM_SIZE - 3) + #define MVPP2_PE_MAC_UC_PROMISCUOUS (MVPP2_PRS_TCAM_SRAM_SIZE - 2) + #define MVPP2_PE_MAC_NON_PROMISCUOUS (MVPP2_PRS_TCAM_SRAM_SIZE - 1) diff --git a/queue-5.4/net-mvpp2-fix-gop-port-3-networking-complex-control-configurations.patch b/queue-5.4/net-mvpp2-fix-gop-port-3-networking-complex-control-configurations.patch new file mode 100644 index 00000000000..79433e5ab07 --- /dev/null +++ b/queue-5.4/net-mvpp2-fix-gop-port-3-networking-complex-control-configurations.patch @@ -0,0 +1,34 @@ +From foo@baz Sun Jan 10 11:49:07 AM CET 2021 +From: Stefan Chulski +Date: Sun, 20 Dec 2020 13:02:29 +0200 +Subject: net: mvpp2: Fix GoP port 3 Networking Complex Control configurations + +From: Stefan Chulski + +[ Upstream commit 2575bc1aa9d52a62342b57a0b7d0a12146cf6aed ] + +During GoP port 2 Networking Complex Control mode of operation configurations, +also GoP port 3 mode of operation was wrongly set. +Patch removes these configurations. + +Fixes: f84bf386f395 ("net: mvpp2: initialize the GoP") +Acked-by: Marcin Wojtas +Signed-off-by: Stefan Chulski +Link: https://lore.kernel.org/r/1608462149-1702-1-git-send-email-stefanc@marvell.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c ++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c +@@ -1129,7 +1129,7 @@ static void mvpp22_gop_init_rgmii(struct + + regmap_read(priv->sysctrl_base, GENCONF_CTRL0, &val); + if (port->gop_id == 2) +- val |= GENCONF_CTRL0_PORT0_RGMII | GENCONF_CTRL0_PORT1_RGMII; ++ val |= GENCONF_CTRL0_PORT0_RGMII; + else if (port->gop_id == 3) + val |= GENCONF_CTRL0_PORT1_RGMII_MII; + regmap_write(priv->sysctrl_base, GENCONF_CTRL0, val); diff --git a/queue-5.4/net-mvpp2-fix-pkt-coalescing-int-threshold-configuration.patch b/queue-5.4/net-mvpp2-fix-pkt-coalescing-int-threshold-configuration.patch new file mode 100644 index 00000000000..618fe67dddd --- /dev/null +++ b/queue-5.4/net-mvpp2-fix-pkt-coalescing-int-threshold-configuration.patch @@ -0,0 +1,48 @@ +From foo@baz Sun Jan 10 11:49:07 AM CET 2021 +From: Stefan Chulski +Date: Wed, 23 Dec 2020 20:35:21 +0200 +Subject: net: mvpp2: fix pkt coalescing int-threshold configuration + +From: Stefan Chulski + +[ Upstream commit 4f374d2c43a9e5e773f1dee56db63bd6b8a36276 ] + +The packet coalescing interrupt threshold has separated registers +for different aggregated/cpu (sw-thread). The required value should +be loaded for every thread but not only for 1 current cpu. + +Fixes: 213f428f5056 ("net: mvpp2: add support for TX interrupts and RX queue distribution modes") +Signed-off-by: Stefan Chulski +Link: https://lore.kernel.org/r/1608748521-11033-1-git-send-email-stefanc@marvell.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c ++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c +@@ -2161,17 +2161,18 @@ static void mvpp2_rx_pkts_coal_set(struc + static void mvpp2_tx_pkts_coal_set(struct mvpp2_port *port, + struct mvpp2_tx_queue *txq) + { +- unsigned int thread = mvpp2_cpu_to_thread(port->priv, get_cpu()); ++ unsigned int thread; + u32 val; + + if (txq->done_pkts_coal > MVPP2_TXQ_THRESH_MASK) + txq->done_pkts_coal = MVPP2_TXQ_THRESH_MASK; + + val = (txq->done_pkts_coal << MVPP2_TXQ_THRESH_OFFSET); +- mvpp2_thread_write(port->priv, thread, MVPP2_TXQ_NUM_REG, txq->id); +- mvpp2_thread_write(port->priv, thread, MVPP2_TXQ_THRESH_REG, val); +- +- put_cpu(); ++ /* PKT-coalescing registers are per-queue + per-thread */ ++ for (thread = 0; thread < MVPP2_MAX_THREADS; thread++) { ++ mvpp2_thread_write(port->priv, thread, MVPP2_TXQ_NUM_REG, txq->id); ++ mvpp2_thread_write(port->priv, thread, MVPP2_TXQ_THRESH_REG, val); ++ } + } + + static u32 mvpp2_usec_to_cycles(u32 usec, unsigned long clk_hz) diff --git a/queue-5.4/net-mvpp2-prs-fix-pppoe-with-ipv6-packet-parse.patch b/queue-5.4/net-mvpp2-prs-fix-pppoe-with-ipv6-packet-parse.patch new file mode 100644 index 00000000000..87c22ac81c8 --- /dev/null +++ b/queue-5.4/net-mvpp2-prs-fix-pppoe-with-ipv6-packet-parse.patch @@ -0,0 +1,36 @@ +From foo@baz Sun Jan 10 11:49:07 AM CET 2021 +From: Stefan Chulski +Date: Thu, 17 Dec 2020 20:37:46 +0200 +Subject: net: mvpp2: prs: fix PPPoE with ipv6 packet parse + +From: Stefan Chulski + +[ Upstream commit fec6079b2eeab319d9e3d074f54d3b6f623e9701 ] + +Current PPPoE+IPv6 entry is jumping to 'next-hdr' +field and not to 'DIP' field as done for IPv4. + +Fixes: 3f518509dedc ("ethernet: Add new driver for Marvell Armada 375 network unit") +Reported-by: Liron Himi +Signed-off-by: Stefan Chulski +Link: https://lore.kernel.org/r/1608230266-22111-1-git-send-email-stefanc@marvell.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c ++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c +@@ -1680,8 +1680,9 @@ static int mvpp2_prs_pppoe_init(struct m + mvpp2_prs_sram_next_lu_set(&pe, MVPP2_PRS_LU_IP6); + mvpp2_prs_sram_ri_update(&pe, MVPP2_PRS_RI_L3_IP6, + MVPP2_PRS_RI_L3_PROTO_MASK); +- /* Skip eth_type + 4 bytes of IPv6 header */ +- mvpp2_prs_sram_shift_set(&pe, MVPP2_ETH_TYPE_LEN + 4, ++ /* Jump to DIP of IPV6 header */ ++ mvpp2_prs_sram_shift_set(&pe, MVPP2_ETH_TYPE_LEN + 8 + ++ MVPP2_MAX_L3_ADDR_SIZE, + MVPP2_PRS_SRAM_OP_SEL_SHIFT_ADD); + /* Set L3 offset */ + mvpp2_prs_sram_offset_set(&pe, MVPP2_PRS_SRAM_UDF_TYPE_L3, diff --git a/queue-5.4/net-ncsi-use-real-net-device-for-response-handler.patch b/queue-5.4/net-ncsi-use-real-net-device-for-response-handler.patch new file mode 100644 index 00000000000..cdda4b17e1f --- /dev/null +++ b/queue-5.4/net-ncsi-use-real-net-device-for-response-handler.patch @@ -0,0 +1,34 @@ +From foo@baz Sun Jan 10 11:49:07 AM CET 2021 +From: John Wang +Date: Wed, 23 Dec 2020 13:55:23 +0800 +Subject: net/ncsi: Use real net-device for response handler + +From: John Wang + +[ Upstream commit 427c940558560bff2583d07fc119a21094675982 ] + +When aggregating ncsi interfaces and dedicated interfaces to bond +interfaces, the ncsi response handler will use the wrong net device to +find ncsi_dev, so that the ncsi interface will not work properly. +Here, we use the original net device to fix it. + +Fixes: 138635cc27c9 ("net/ncsi: NCSI response packet handler") +Signed-off-by: John Wang +Link: https://lore.kernel.org/r/20201223055523.2069-1-wangzhiqiang.bj@bytedance.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/ncsi/ncsi-rsp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/ncsi/ncsi-rsp.c ++++ b/net/ncsi/ncsi-rsp.c +@@ -1114,7 +1114,7 @@ int ncsi_rcv_rsp(struct sk_buff *skb, st + int payload, i, ret; + + /* Find the NCSI device */ +- nd = ncsi_find_dev(dev); ++ nd = ncsi_find_dev(orig_dev); + ndp = nd ? TO_NCSI_DEV_PRIV(nd) : NULL; + if (!ndp) + return -ENODEV; diff --git a/queue-5.4/net-sched-prevent-invalid-scell_log-shift-count.patch b/queue-5.4/net-sched-prevent-invalid-scell_log-shift-count.patch new file mode 100644 index 00000000000..d6956a24afc --- /dev/null +++ b/queue-5.4/net-sched-prevent-invalid-scell_log-shift-count.patch @@ -0,0 +1,98 @@ +From foo@baz Sun Jan 10 11:49:07 AM CET 2021 +From: Randy Dunlap +Date: Thu, 24 Dec 2020 22:23:44 -0800 +Subject: net: sched: prevent invalid Scell_log shift count + +From: Randy Dunlap + +[ Upstream commit bd1248f1ddbc48b0c30565fce897a3b6423313b8 ] + +Check Scell_log shift size in red_check_params() and modify all callers +of red_check_params() to pass Scell_log. + +This prevents a shift out-of-bounds as detected by UBSAN: + UBSAN: shift-out-of-bounds in ./include/net/red.h:252:22 + shift exponent 72 is too large for 32-bit type 'int' + +Fixes: 8afa10cbe281 ("net_sched: red: Avoid illegal values") +Signed-off-by: Randy Dunlap +Reported-by: syzbot+97c5bd9cc81eca63d36e@syzkaller.appspotmail.com +Cc: Nogah Frankel +Cc: Jamal Hadi Salim +Cc: Cong Wang +Cc: Jiri Pirko +Cc: netdev@vger.kernel.org +Cc: "David S. Miller" +Cc: Jakub Kicinski +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + include/net/red.h | 4 +++- + net/sched/sch_choke.c | 2 +- + net/sched/sch_gred.c | 2 +- + net/sched/sch_red.c | 2 +- + net/sched/sch_sfq.c | 2 +- + 5 files changed, 7 insertions(+), 5 deletions(-) + +--- a/include/net/red.h ++++ b/include/net/red.h +@@ -168,12 +168,14 @@ static inline void red_set_vars(struct r + v->qcount = -1; + } + +-static inline bool red_check_params(u32 qth_min, u32 qth_max, u8 Wlog) ++static inline bool red_check_params(u32 qth_min, u32 qth_max, u8 Wlog, u8 Scell_log) + { + if (fls(qth_min) + Wlog > 32) + return false; + if (fls(qth_max) + Wlog > 32) + return false; ++ if (Scell_log >= 32) ++ return false; + if (qth_max < qth_min) + return false; + return true; +--- a/net/sched/sch_choke.c ++++ b/net/sched/sch_choke.c +@@ -368,7 +368,7 @@ static int choke_change(struct Qdisc *sc + + ctl = nla_data(tb[TCA_CHOKE_PARMS]); + +- if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog)) ++ if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log)) + return -EINVAL; + + if (ctl->limit > CHOKE_MAX_QUEUE) +--- a/net/sched/sch_gred.c ++++ b/net/sched/sch_gred.c +@@ -480,7 +480,7 @@ static inline int gred_change_vq(struct + struct gred_sched *table = qdisc_priv(sch); + struct gred_sched_data *q = table->tab[dp]; + +- if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog)) { ++ if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log)) { + NL_SET_ERR_MSG_MOD(extack, "invalid RED parameters"); + return -EINVAL; + } +--- a/net/sched/sch_red.c ++++ b/net/sched/sch_red.c +@@ -213,7 +213,7 @@ static int red_change(struct Qdisc *sch, + max_P = tb[TCA_RED_MAX_P] ? nla_get_u32(tb[TCA_RED_MAX_P]) : 0; + + ctl = nla_data(tb[TCA_RED_PARMS]); +- if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog)) ++ if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log)) + return -EINVAL; + + if (ctl->limit > 0) { +--- a/net/sched/sch_sfq.c ++++ b/net/sched/sch_sfq.c +@@ -647,7 +647,7 @@ static int sfq_change(struct Qdisc *sch, + } + + if (ctl_v1 && !red_check_params(ctl_v1->qth_min, ctl_v1->qth_max, +- ctl_v1->Wlog)) ++ ctl_v1->Wlog, ctl_v1->Scell_log)) + return -EINVAL; + if (ctl_v1 && ctl_v1->qth_min) { + p = kmalloc(sizeof(*p), GFP_KERNEL); diff --git a/queue-5.4/net-sched-sch_taprio-ensure-to-reset-destroy-all-child-qdiscs.patch b/queue-5.4/net-sched-sch_taprio-ensure-to-reset-destroy-all-child-qdiscs.patch new file mode 100644 index 00000000000..fa5b789b3a9 --- /dev/null +++ b/queue-5.4/net-sched-sch_taprio-ensure-to-reset-destroy-all-child-qdiscs.patch @@ -0,0 +1,36 @@ +From foo@baz Sun Jan 10 11:49:07 AM CET 2021 +From: Davide Caratti +Date: Thu, 17 Dec 2020 22:29:46 +0100 +Subject: net/sched: sch_taprio: ensure to reset/destroy all child qdiscs + +From: Davide Caratti + +[ Upstream commit 698285da79f5b0b099db15a37ac661ac408c80eb ] + +taprio_graft() can insert a NULL element in the array of child qdiscs. As +a consquence, taprio_reset() might not reset child qdiscs completely, and +taprio_destroy() might leak resources. Fix it by ensuring that loops that +iterate over q->qdiscs[] don't end when they find the first NULL item. + +Fixes: 44d4775ca518 ("net/sched: sch_taprio: reset child qdiscs before freeing them") +Fixes: 5a781ccbd19e ("tc: Add support for configuring the taprio scheduler") +Suggested-by: Jakub Kicinski +Signed-off-by: Davide Caratti +Link: https://lore.kernel.org/r/13edef6778fef03adc751582562fba4a13e06d6a.1608240532.git.dcaratti@redhat.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/sched/sch_taprio.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/sched/sch_taprio.c ++++ b/net/sched/sch_taprio.c +@@ -1612,7 +1612,7 @@ static void taprio_destroy(struct Qdisc + taprio_disable_offload(dev, q, NULL); + + if (q->qdiscs) { +- for (i = 0; i < dev->num_tx_queues && q->qdiscs[i]; i++) ++ for (i = 0; i < dev->num_tx_queues; i++) + qdisc_put(q->qdiscs[i]); + + kfree(q->qdiscs); diff --git a/queue-5.4/net-sysfs-take-the-rtnl-lock-when-accessing-xps_cpus_map-and-num_tc.patch b/queue-5.4/net-sysfs-take-the-rtnl-lock-when-accessing-xps_cpus_map-and-num_tc.patch new file mode 100644 index 00000000000..f9bca06e027 --- /dev/null +++ b/queue-5.4/net-sysfs-take-the-rtnl-lock-when-accessing-xps_cpus_map-and-num_tc.patch @@ -0,0 +1,89 @@ +From foo@baz Sun Jan 10 11:49:07 AM CET 2021 +From: Antoine Tenart +Date: Wed, 23 Dec 2020 22:23:21 +0100 +Subject: net-sysfs: take the rtnl lock when accessing xps_cpus_map and num_tc + +From: Antoine Tenart + +[ Upstream commit fb25038586d0064123e393cadf1fadd70a9df97a ] + +Accesses to dev->xps_cpus_map (when using dev->num_tc) should be +protected by the rtnl lock, like we do for netif_set_xps_queue. I didn't +see an actual bug being triggered, but let's be safe here and take the +rtnl lock while accessing the map in sysfs. + +Fixes: 184c449f91fe ("net: Add support for XPS with QoS via traffic classes") +Signed-off-by: Antoine Tenart +Reviewed-by: Alexander Duyck +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/core/net-sysfs.c | 29 ++++++++++++++++++++++------- + 1 file changed, 22 insertions(+), 7 deletions(-) + +--- a/net/core/net-sysfs.c ++++ b/net/core/net-sysfs.c +@@ -1235,8 +1235,8 @@ static const struct attribute_group dql_ + static ssize_t xps_cpus_show(struct netdev_queue *queue, + char *buf) + { ++ int cpu, len, ret, num_tc = 1, tc = 0; + struct net_device *dev = queue->dev; +- int cpu, len, num_tc = 1, tc = 0; + struct xps_dev_maps *dev_maps; + cpumask_var_t mask; + unsigned long index; +@@ -1246,22 +1246,31 @@ static ssize_t xps_cpus_show(struct netd + + index = get_netdev_queue_index(queue); + ++ if (!rtnl_trylock()) ++ return restart_syscall(); ++ + if (dev->num_tc) { + /* Do not allow XPS on subordinate device directly */ + num_tc = dev->num_tc; +- if (num_tc < 0) +- return -EINVAL; ++ if (num_tc < 0) { ++ ret = -EINVAL; ++ goto err_rtnl_unlock; ++ } + + /* If queue belongs to subordinate dev use its map */ + dev = netdev_get_tx_queue(dev, index)->sb_dev ? : dev; + + tc = netdev_txq_to_tc(dev, index); +- if (tc < 0) +- return -EINVAL; ++ if (tc < 0) { ++ ret = -EINVAL; ++ goto err_rtnl_unlock; ++ } + } + +- if (!zalloc_cpumask_var(&mask, GFP_KERNEL)) +- return -ENOMEM; ++ if (!zalloc_cpumask_var(&mask, GFP_KERNEL)) { ++ ret = -ENOMEM; ++ goto err_rtnl_unlock; ++ } + + rcu_read_lock(); + dev_maps = rcu_dereference(dev->xps_cpus_map); +@@ -1284,9 +1293,15 @@ static ssize_t xps_cpus_show(struct netd + } + rcu_read_unlock(); + ++ rtnl_unlock(); ++ + len = snprintf(buf, PAGE_SIZE, "%*pb\n", cpumask_pr_args(mask)); + free_cpumask_var(mask); + return len < PAGE_SIZE ? len : -EINVAL; ++ ++err_rtnl_unlock: ++ rtnl_unlock(); ++ return ret; + } + + static ssize_t xps_cpus_store(struct netdev_queue *queue, diff --git a/queue-5.4/net-sysfs-take-the-rtnl-lock-when-accessing-xps_rxqs_map-and-num_tc.patch b/queue-5.4/net-sysfs-take-the-rtnl-lock-when-accessing-xps_rxqs_map-and-num_tc.patch new file mode 100644 index 00000000000..30b765a03f6 --- /dev/null +++ b/queue-5.4/net-sysfs-take-the-rtnl-lock-when-accessing-xps_rxqs_map-and-num_tc.patch @@ -0,0 +1,77 @@ +From foo@baz Sun Jan 10 11:49:07 AM CET 2021 +From: Antoine Tenart +Date: Wed, 23 Dec 2020 22:23:23 +0100 +Subject: net-sysfs: take the rtnl lock when accessing xps_rxqs_map and num_tc + +From: Antoine Tenart + +[ Upstream commit 4ae2bb81649dc03dfc95875f02126b14b773f7ab ] + +Accesses to dev->xps_rxqs_map (when using dev->num_tc) should be +protected by the rtnl lock, like we do for netif_set_xps_queue. I didn't +see an actual bug being triggered, but let's be safe here and take the +rtnl lock while accessing the map in sysfs. + +Fixes: 8af2c06ff4b1 ("net-sysfs: Add interface for Rx queue(s) map per Tx queue") +Signed-off-by: Antoine Tenart +Reviewed-by: Alexander Duyck +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/core/net-sysfs.c | 23 ++++++++++++++++++----- + 1 file changed, 18 insertions(+), 5 deletions(-) + +--- a/net/core/net-sysfs.c ++++ b/net/core/net-sysfs.c +@@ -1347,22 +1347,29 @@ static struct netdev_queue_attribute xps + + static ssize_t xps_rxqs_show(struct netdev_queue *queue, char *buf) + { ++ int j, len, ret, num_tc = 1, tc = 0; + struct net_device *dev = queue->dev; + struct xps_dev_maps *dev_maps; + unsigned long *mask, index; +- int j, len, num_tc = 1, tc = 0; + + index = get_netdev_queue_index(queue); + ++ if (!rtnl_trylock()) ++ return restart_syscall(); ++ + if (dev->num_tc) { + num_tc = dev->num_tc; + tc = netdev_txq_to_tc(dev, index); +- if (tc < 0) +- return -EINVAL; ++ if (tc < 0) { ++ ret = -EINVAL; ++ goto err_rtnl_unlock; ++ } + } + mask = bitmap_zalloc(dev->num_rx_queues, GFP_KERNEL); +- if (!mask) +- return -ENOMEM; ++ if (!mask) { ++ ret = -ENOMEM; ++ goto err_rtnl_unlock; ++ } + + rcu_read_lock(); + dev_maps = rcu_dereference(dev->xps_rxqs_map); +@@ -1388,10 +1395,16 @@ static ssize_t xps_rxqs_show(struct netd + out_no_maps: + rcu_read_unlock(); + ++ rtnl_unlock(); ++ + len = bitmap_print_to_pagebuf(false, buf, mask, dev->num_rx_queues); + bitmap_free(mask); + + return len < PAGE_SIZE ? len : -EINVAL; ++ ++err_rtnl_unlock: ++ rtnl_unlock(); ++ return ret; + } + + static ssize_t xps_rxqs_store(struct netdev_queue *queue, const char *buf, diff --git a/queue-5.4/net-sysfs-take-the-rtnl-lock-when-storing-xps_cpus.patch b/queue-5.4/net-sysfs-take-the-rtnl-lock-when-storing-xps_cpus.patch new file mode 100644 index 00000000000..be4bb4d94c4 --- /dev/null +++ b/queue-5.4/net-sysfs-take-the-rtnl-lock-when-storing-xps_cpus.patch @@ -0,0 +1,75 @@ +From foo@baz Sun Jan 10 11:49:07 AM CET 2021 +From: Antoine Tenart +Date: Wed, 23 Dec 2020 22:23:20 +0100 +Subject: net-sysfs: take the rtnl lock when storing xps_cpus + +From: Antoine Tenart + +[ Upstream commit 1ad58225dba3f2f598d2c6daed4323f24547168f ] + +Two race conditions can be triggered when storing xps cpus, resulting in +various oops and invalid memory accesses: + +1. Calling netdev_set_num_tc while netif_set_xps_queue: + + - netif_set_xps_queue uses dev->tc_num as one of the parameters to + compute the size of new_dev_maps when allocating it. dev->tc_num is + also used to access the map, and the compiler may generate code to + retrieve this field multiple times in the function. + + - netdev_set_num_tc sets dev->tc_num. + + If new_dev_maps is allocated using dev->tc_num and then dev->tc_num + is set to a higher value through netdev_set_num_tc, later accesses to + new_dev_maps in netif_set_xps_queue could lead to accessing memory + outside of new_dev_maps; triggering an oops. + +2. Calling netif_set_xps_queue while netdev_set_num_tc is running: + + 2.1. netdev_set_num_tc starts by resetting the xps queues, + dev->tc_num isn't updated yet. + + 2.2. netif_set_xps_queue is called, setting up the map with the + *old* dev->num_tc. + + 2.3. netdev_set_num_tc updates dev->tc_num. + + 2.4. Later accesses to the map lead to out of bound accesses and + oops. + + A similar issue can be found with netdev_reset_tc. + +One way of triggering this is to set an iface up (for which the driver +uses netdev_set_num_tc in the open path, such as bnx2x) and writing to +xps_cpus in a concurrent thread. With the right timing an oops is +triggered. + +Both issues have the same fix: netif_set_xps_queue, netdev_set_num_tc +and netdev_reset_tc should be mutually exclusive. We do that by taking +the rtnl lock in xps_cpus_store. + +Fixes: 184c449f91fe ("net: Add support for XPS with QoS via traffic classes") +Signed-off-by: Antoine Tenart +Reviewed-by: Alexander Duyck +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/core/net-sysfs.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/net/core/net-sysfs.c ++++ b/net/core/net-sysfs.c +@@ -1314,7 +1314,13 @@ static ssize_t xps_cpus_store(struct net + return err; + } + ++ if (!rtnl_trylock()) { ++ free_cpumask_var(mask); ++ return restart_syscall(); ++ } ++ + err = netif_set_xps_queue(dev, mask, index); ++ rtnl_unlock(); + + free_cpumask_var(mask); + diff --git a/queue-5.4/net-sysfs-take-the-rtnl-lock-when-storing-xps_rxqs.patch b/queue-5.4/net-sysfs-take-the-rtnl-lock-when-storing-xps_rxqs.patch new file mode 100644 index 00000000000..b5e0f1da04d --- /dev/null +++ b/queue-5.4/net-sysfs-take-the-rtnl-lock-when-storing-xps_rxqs.patch @@ -0,0 +1,79 @@ +From foo@baz Sun Jan 10 11:49:07 AM CET 2021 +From: Antoine Tenart +Date: Wed, 23 Dec 2020 22:23:22 +0100 +Subject: net-sysfs: take the rtnl lock when storing xps_rxqs + +From: Antoine Tenart + +[ Upstream commit 2d57b4f142e0b03e854612b8e28978935414bced ] + +Two race conditions can be triggered when storing xps rxqs, resulting in +various oops and invalid memory accesses: + +1. Calling netdev_set_num_tc while netif_set_xps_queue: + + - netif_set_xps_queue uses dev->tc_num as one of the parameters to + compute the size of new_dev_maps when allocating it. dev->tc_num is + also used to access the map, and the compiler may generate code to + retrieve this field multiple times in the function. + + - netdev_set_num_tc sets dev->tc_num. + + If new_dev_maps is allocated using dev->tc_num and then dev->tc_num + is set to a higher value through netdev_set_num_tc, later accesses to + new_dev_maps in netif_set_xps_queue could lead to accessing memory + outside of new_dev_maps; triggering an oops. + +2. Calling netif_set_xps_queue while netdev_set_num_tc is running: + + 2.1. netdev_set_num_tc starts by resetting the xps queues, + dev->tc_num isn't updated yet. + + 2.2. netif_set_xps_queue is called, setting up the map with the + *old* dev->num_tc. + + 2.3. netdev_set_num_tc updates dev->tc_num. + + 2.4. Later accesses to the map lead to out of bound accesses and + oops. + + A similar issue can be found with netdev_reset_tc. + +One way of triggering this is to set an iface up (for which the driver +uses netdev_set_num_tc in the open path, such as bnx2x) and writing to +xps_rxqs in a concurrent thread. With the right timing an oops is +triggered. + +Both issues have the same fix: netif_set_xps_queue, netdev_set_num_tc +and netdev_reset_tc should be mutually exclusive. We do that by taking +the rtnl lock in xps_rxqs_store. + +Fixes: 8af2c06ff4b1 ("net-sysfs: Add interface for Rx queue(s) map per Tx queue") +Signed-off-by: Antoine Tenart +Reviewed-by: Alexander Duyck +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/core/net-sysfs.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/net/core/net-sysfs.c ++++ b/net/core/net-sysfs.c +@@ -1417,10 +1417,17 @@ static ssize_t xps_rxqs_store(struct net + return err; + } + ++ if (!rtnl_trylock()) { ++ bitmap_free(mask); ++ return restart_syscall(); ++ } ++ + cpus_read_lock(); + err = __netif_set_xps_queue(dev, mask, index, true); + cpus_read_unlock(); + ++ rtnl_unlock(); ++ + bitmap_free(mask); + return err ? : len; + } diff --git a/queue-5.4/net-systemport-set-dev-max_mtu-to-umac_max_mtu_size.patch b/queue-5.4/net-systemport-set-dev-max_mtu-to-umac_max_mtu_size.patch new file mode 100644 index 00000000000..085bc5b3ee2 --- /dev/null +++ b/queue-5.4/net-systemport-set-dev-max_mtu-to-umac_max_mtu_size.patch @@ -0,0 +1,32 @@ +From foo@baz Sun Jan 10 11:49:07 AM CET 2021 +From: Florian Fainelli +Date: Fri, 18 Dec 2020 09:38:43 -0800 +Subject: net: systemport: set dev->max_mtu to UMAC_MAX_MTU_SIZE + +From: Florian Fainelli + +[ Upstream commit 54ddbdb024882e226055cc4c3c246592ddde2ee5 ] + +The driver is already allocating receive buffers of 2KiB and the +Ethernet MAC is configured to accept frames up to UMAC_MAX_MTU_SIZE. + +Fixes: bfcb813203e6 ("net: dsa: configure the MTU for switch ports") +Signed-off-by: Florian Fainelli +Reviewed-by: Vladimir Oltean +Link: https://lore.kernel.org/r/20201218173843.141046-1-f.fainelli@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/broadcom/bcmsysport.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/ethernet/broadcom/bcmsysport.c ++++ b/drivers/net/ethernet/broadcom/bcmsysport.c +@@ -2520,6 +2520,7 @@ static int bcm_sysport_probe(struct plat + NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM; + dev->hw_features |= dev->features; + dev->vlan_features |= dev->features; ++ dev->max_mtu = UMAC_MAX_MTU_SIZE; + + /* Request the WOL interrupt and advertise suspend if available */ + priv->wol_irq_disabled = 1; diff --git a/queue-5.4/net-usb-qmi_wwan-add-quectel-em160r-gl.patch b/queue-5.4/net-usb-qmi_wwan-add-quectel-em160r-gl.patch new file mode 100644 index 00000000000..fb4315ed5cb --- /dev/null +++ b/queue-5.4/net-usb-qmi_wwan-add-quectel-em160r-gl.patch @@ -0,0 +1,57 @@ +From foo@baz Sun Jan 10 11:49:07 AM CET 2021 +From: "Bjørn Mork" +Date: Wed, 30 Dec 2020 16:24:51 +0100 +Subject: net: usb: qmi_wwan: add Quectel EM160R-GL + +From: "Bjørn Mork" + +[ Upstream commit cfd82dfc9799c53ef109343a23af006a0f6860a9 ] + +New modem using ff/ff/30 for QCDM, ff/00/00 for AT and NMEA, +and ff/ff/ff for RMNET/QMI. + +T: Bus=02 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=5000 MxCh= 0 +D: Ver= 3.20 Cls=ef(misc ) Sub=02 Prot=01 MxPS= 9 #Cfgs= 1 +P: Vendor=2c7c ProdID=0620 Rev= 4.09 +S: Manufacturer=Quectel +S: Product=EM160R-GL +S: SerialNumber=e31cedc1 +C:* #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=896mA +I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=(none) +E: Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) +E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=82(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) +E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=84(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) +E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=86(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=04(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) +E: Ad=88(I) Atr=03(Int.) MxPS= 8 Ivl=32ms +E: Ad=8e(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=0f(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms + +Signed-off-by: Bjørn Mork +Link: https://lore.kernel.org/r/20201230152451.245271-1-bjorn@mork.no +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/usb/qmi_wwan.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -1058,6 +1058,7 @@ static const struct usb_device_id produc + {QMI_MATCH_FF_FF_FF(0x2c7c, 0x0125)}, /* Quectel EC25, EC20 R2.0 Mini PCIe */ + {QMI_MATCH_FF_FF_FF(0x2c7c, 0x0306)}, /* Quectel EP06/EG06/EM06 */ + {QMI_MATCH_FF_FF_FF(0x2c7c, 0x0512)}, /* Quectel EG12/EM12 */ ++ {QMI_MATCH_FF_FF_FF(0x2c7c, 0x0620)}, /* Quectel EM160R-GL */ + {QMI_MATCH_FF_FF_FF(0x2c7c, 0x0800)}, /* Quectel RM500Q-GL */ + + /* 3. Combined interface devices matching on interface number */ diff --git a/queue-5.4/qede-fix-offload-for-ipip-tunnel-packets.patch b/queue-5.4/qede-fix-offload-for-ipip-tunnel-packets.patch new file mode 100644 index 00000000000..a5df04d9dac --- /dev/null +++ b/queue-5.4/qede-fix-offload-for-ipip-tunnel-packets.patch @@ -0,0 +1,38 @@ +From foo@baz Sun Jan 10 11:49:07 AM CET 2021 +From: Manish Chopra +Date: Mon, 21 Dec 2020 06:55:30 -0800 +Subject: qede: fix offload for IPIP tunnel packets + +From: Manish Chopra + +[ Upstream commit 5d5647dad259bb416fd5d3d87012760386d97530 ] + +IPIP tunnels packets are unknown to device, +hence these packets are incorrectly parsed and +caused the packet corruption, so disable offlods +for such packets at run time. + +Signed-off-by: Manish Chopra +Signed-off-by: Sudarsana Kalluru +Signed-off-by: Igor Russkikh +Link: https://lore.kernel.org/r/20201221145530.7771-1-manishc@marvell.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/qlogic/qede/qede_fp.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/net/ethernet/qlogic/qede/qede_fp.c ++++ b/drivers/net/ethernet/qlogic/qede/qede_fp.c +@@ -1737,6 +1737,11 @@ netdev_features_t qede_features_check(st + ntohs(udp_hdr(skb)->dest) != gnv_port)) + return features & ~(NETIF_F_CSUM_MASK | + NETIF_F_GSO_MASK); ++ } else if (l4_proto == IPPROTO_IPIP) { ++ /* IPIP tunnels are unknown to the device or at least unsupported natively, ++ * offloads for them can't be done trivially, so disable them for such skb. ++ */ ++ return features & ~(NETIF_F_CSUM_MASK | NETIF_F_GSO_MASK); + } + } + diff --git a/queue-5.4/r8169-work-around-power-saving-bug-on-some-chip-versions.patch b/queue-5.4/r8169-work-around-power-saving-bug-on-some-chip-versions.patch new file mode 100644 index 00000000000..96247f31375 --- /dev/null +++ b/queue-5.4/r8169-work-around-power-saving-bug-on-some-chip-versions.patch @@ -0,0 +1,44 @@ +From foo@baz Sun Jan 10 11:49:07 AM CET 2021 +From: Heiner Kallweit +Date: Wed, 30 Dec 2020 19:33:34 +0100 +Subject: r8169: work around power-saving bug on some chip versions + +From: Heiner Kallweit + +[ Upstream commit e80bd76fbf563cc7ed8c9e9f3bbcdf59b0897f69 ] + +A user reported failing network with RTL8168dp (a quite rare chip +version). Realtek confirmed that few chip versions suffer from a PLL +power-down hw bug. + +Fixes: 07df5bd874f0 ("r8169: power down chip in probe") +Signed-off-by: Heiner Kallweit +Link: https://lore.kernel.org/r/a1c39460-d533-7f9e-fa9d-2b8990b02426@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/realtek/r8169_main.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/realtek/r8169_main.c ++++ b/drivers/net/ethernet/realtek/r8169_main.c +@@ -3958,7 +3958,8 @@ static void rtl_pll_power_down(struct rt + } + + switch (tp->mac_version) { +- case RTL_GIGA_MAC_VER_25 ... RTL_GIGA_MAC_VER_33: ++ case RTL_GIGA_MAC_VER_25 ... RTL_GIGA_MAC_VER_26: ++ case RTL_GIGA_MAC_VER_32 ... RTL_GIGA_MAC_VER_33: + case RTL_GIGA_MAC_VER_37: + case RTL_GIGA_MAC_VER_39: + case RTL_GIGA_MAC_VER_43: +@@ -3987,7 +3988,8 @@ static void rtl_pll_power_down(struct rt + static void rtl_pll_power_up(struct rtl8169_private *tp) + { + switch (tp->mac_version) { +- case RTL_GIGA_MAC_VER_25 ... RTL_GIGA_MAC_VER_33: ++ case RTL_GIGA_MAC_VER_25 ... RTL_GIGA_MAC_VER_26: ++ case RTL_GIGA_MAC_VER_32 ... RTL_GIGA_MAC_VER_33: + case RTL_GIGA_MAC_VER_37: + case RTL_GIGA_MAC_VER_39: + case RTL_GIGA_MAC_VER_43: diff --git a/queue-5.4/series b/queue-5.4/series index 106cf91ae53..f690c899014 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -7,3 +7,39 @@ lib-genalloc-fix-the-overflow-when-size-is-too-big.patch depmod-handle-the-case-of-sbin-depmod-without-sbin-i.patch proc-change-nlink-under-proc_subdir_lock.patch proc-fix-lookup-in-proc-net-subdirectories-after-set.patch +i40e-fix-error-i40e_aq_rc_einval-when-removing-vfs.patch +iavf-fix-double-release-of-rtnl_lock.patch +net-mvpp2-add-tcam-entry-to-drop-flow-control-pause-frames.patch +net-mvpp2-prs-fix-pppoe-with-ipv6-packet-parse.patch +net-systemport-set-dev-max_mtu-to-umac_max_mtu_size.patch +ethernet-ucc_geth-fix-use-after-free-in-ucc_geth_remove.patch +ethernet-ucc_geth-set-dev-max_mtu-to-1518.patch +atm-idt77252-call-pci_disable_device-on-error-path.patch +net-mvpp2-fix-gop-port-3-networking-complex-control-configurations.patch +ibmvnic-continue-fatal-error-reset-after-passive-init.patch +net-ethernet-mvneta-fix-error-handling-in-mvneta_probe.patch +qede-fix-offload-for-ipip-tunnel-packets.patch +virtio_net-fix-recursive-call-to-cpus_read_lock.patch +net-dcb-validate-netlink-message-in-dcb-handler.patch +net-ncsi-use-real-net-device-for-response-handler.patch +net-ethernet-fix-memleak-in-ethoc_probe.patch +net-sysfs-take-the-rtnl-lock-when-storing-xps_cpus.patch +net-sysfs-take-the-rtnl-lock-when-accessing-xps_cpus_map-and-num_tc.patch +net-sysfs-take-the-rtnl-lock-when-storing-xps_rxqs.patch +net-sysfs-take-the-rtnl-lock-when-accessing-xps_rxqs_map-and-num_tc.patch +net-ethernet-ti-cpts-fix-ethtool-output-when-no-ptp_clock-registered.patch +tun-fix-return-value-when-the-number-of-iovs-exceeds-max_skb_frags.patch +net-mvpp2-fix-pkt-coalescing-int-threshold-configuration.patch +ipv4-ignore-ecn-bits-for-fib-lookups-in-fib_compute_spec_dst.patch +net-sched-prevent-invalid-scell_log-shift-count.patch +net-hns-fix-return-value-check-in-__lb_other_process.patch +erspan-fix-version-1-check-in-gre_parse_header.patch +net-hdlc_ppp-fix-issues-when-mod_timer-is-called-while-timer-is-running.patch +r8169-work-around-power-saving-bug-on-some-chip-versions.patch +net-dsa-lantiq_gswip-enable-gswip_mii_cfg_en-also-for-internal-phys.patch +net-dsa-lantiq_gswip-fix-gswip_mii_cfg-p-register-access.patch +cdc-ncm-remove-connected-log-message.patch +net-usb-qmi_wwan-add-quectel-em160r-gl.patch +vhost_net-fix-ubuf-refcount-incorrectly-when-sendmsg-fails.patch +ionic-account-for-vlan-tag-len-in-rx-buffer-len.patch +net-sched-sch_taprio-ensure-to-reset-destroy-all-child-qdiscs.patch diff --git a/queue-5.4/tun-fix-return-value-when-the-number-of-iovs-exceeds-max_skb_frags.patch b/queue-5.4/tun-fix-return-value-when-the-number-of-iovs-exceeds-max_skb_frags.patch new file mode 100644 index 00000000000..6bedd6e2f45 --- /dev/null +++ b/queue-5.4/tun-fix-return-value-when-the-number-of-iovs-exceeds-max_skb_frags.patch @@ -0,0 +1,42 @@ +From foo@baz Sun Jan 10 11:49:07 AM CET 2021 +From: Yunjian Wang +Date: Fri, 25 Dec 2020 10:52:16 +0800 +Subject: tun: fix return value when the number of iovs exceeds MAX_SKB_FRAGS + +From: Yunjian Wang + +[ Upstream commit 950271d7cc0b4546af3549d8143c4132d6e1f138 ] + +Currently the tun_napi_alloc_frags() function returns -ENOMEM when the +number of iovs exceeds MAX_SKB_FRAGS + 1. However this is inappropriate, +we should use -EMSGSIZE instead of -ENOMEM. + +The following distinctions are matters: +1. the caller need to drop the bad packet when -EMSGSIZE is returned, + which means meeting a persistent failure. +2. the caller can try again when -ENOMEM is returned, which means + meeting a transient failure. + +Fixes: 90e33d459407 ("tun: enable napi_gro_frags() for TUN/TAP driver") +Signed-off-by: Yunjian Wang +Acked-by: Willem de Bruijn +Acked-by: Jason Wang +Acked-by: Michael S. Tsirkin +Link: https://lore.kernel.org/r/1608864736-24332-1-git-send-email-wangyunjian@huawei.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/tun.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/tun.c ++++ b/drivers/net/tun.c +@@ -1469,7 +1469,7 @@ static struct sk_buff *tun_napi_alloc_fr + int i; + + if (it->nr_segs > MAX_SKB_FRAGS + 1) +- return ERR_PTR(-ENOMEM); ++ return ERR_PTR(-EMSGSIZE); + + local_bh_disable(); + skb = napi_get_frags(&tfile->napi); diff --git a/queue-5.4/vhost_net-fix-ubuf-refcount-incorrectly-when-sendmsg-fails.patch b/queue-5.4/vhost_net-fix-ubuf-refcount-incorrectly-when-sendmsg-fails.patch new file mode 100644 index 00000000000..694695ab637 --- /dev/null +++ b/queue-5.4/vhost_net-fix-ubuf-refcount-incorrectly-when-sendmsg-fails.patch @@ -0,0 +1,57 @@ +From foo@baz Sun Jan 10 11:49:07 AM CET 2021 +From: Yunjian Wang +Date: Tue, 29 Dec 2020 10:01:48 +0800 +Subject: vhost_net: fix ubuf refcount incorrectly when sendmsg fails + +From: Yunjian Wang + +[ Upstream commit 01e31bea7e622f1890c274f4aaaaf8bccd296aa5 ] + +Currently the vhost_zerocopy_callback() maybe be called to decrease +the refcount when sendmsg fails in tun. The error handling in vhost +handle_tx_zerocopy() will try to decrease the same refcount again. +This is wrong. To fix this issue, we only call vhost_net_ubuf_put() +when vq->heads[nvq->desc].len == VHOST_DMA_IN_PROGRESS. + +Fixes: bab632d69ee4 ("vhost: vhost TX zero-copy support") +Signed-off-by: Yunjian Wang +Acked-by: Willem de Bruijn +Acked-by: Michael S. Tsirkin +Acked-by: Jason Wang +Link: https://lore.kernel.org/r/1609207308-20544-1-git-send-email-wangyunjian@huawei.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/vhost/net.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/vhost/net.c ++++ b/drivers/vhost/net.c +@@ -860,6 +860,7 @@ static void handle_tx_zerocopy(struct vh + size_t len, total_len = 0; + int err; + struct vhost_net_ubuf_ref *uninitialized_var(ubufs); ++ struct ubuf_info *ubuf; + bool zcopy_used; + int sent_pkts = 0; + +@@ -892,9 +893,7 @@ static void handle_tx_zerocopy(struct vh + + /* use msg_control to pass vhost zerocopy ubuf info to skb */ + if (zcopy_used) { +- struct ubuf_info *ubuf; + ubuf = nvq->ubuf_info + nvq->upend_idx; +- + vq->heads[nvq->upend_idx].id = cpu_to_vhost32(vq, head); + vq->heads[nvq->upend_idx].len = VHOST_DMA_IN_PROGRESS; + ubuf->callback = vhost_zerocopy_callback; +@@ -924,7 +923,8 @@ static void handle_tx_zerocopy(struct vh + err = sock->ops->sendmsg(sock, &msg, len); + if (unlikely(err < 0)) { + if (zcopy_used) { +- vhost_net_ubuf_put(ubufs); ++ if (vq->heads[ubuf->desc].len == VHOST_DMA_IN_PROGRESS) ++ vhost_net_ubuf_put(ubufs); + nvq->upend_idx = ((unsigned)nvq->upend_idx - 1) + % UIO_MAXIOV; + } diff --git a/queue-5.4/virtio_net-fix-recursive-call-to-cpus_read_lock.patch b/queue-5.4/virtio_net-fix-recursive-call-to-cpus_read_lock.patch new file mode 100644 index 00000000000..2188ae0ca00 --- /dev/null +++ b/queue-5.4/virtio_net-fix-recursive-call-to-cpus_read_lock.patch @@ -0,0 +1,61 @@ +From foo@baz Sun Jan 10 11:49:07 AM CET 2021 +From: Jeff Dike +Date: Tue, 22 Dec 2020 21:54:21 -0500 +Subject: virtio_net: Fix recursive call to cpus_read_lock() + +From: Jeff Dike + +[ Upstream commit de33212f768c5d9e2fe791b008cb26f92f0aa31c ] + +virtnet_set_channels can recursively call cpus_read_lock if CONFIG_XPS +and CONFIG_HOTPLUG are enabled. + +The path is: + virtnet_set_channels - calls get_online_cpus(), which is a trivial +wrapper around cpus_read_lock() + netif_set_real_num_tx_queues + netif_reset_xps_queues_gt + netif_reset_xps_queues - calls cpus_read_lock() + +This call chain and potential deadlock happens when the number of TX +queues is reduced. + +This commit the removes netif_set_real_num_[tr]x_queues calls from +inside the get/put_online_cpus section, as they don't require that it +be held. + +Fixes: 47be24796c13 ("virtio-net: fix the set affinity bug when CPU IDs are not consecutive") +Signed-off-by: Jeff Dike +Acked-by: Jason Wang +Acked-by: Michael S. Tsirkin +Link: https://lore.kernel.org/r/20201223025421.671-1-jdike@akamai.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/virtio_net.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +--- a/drivers/net/virtio_net.c ++++ b/drivers/net/virtio_net.c +@@ -2072,14 +2072,16 @@ static int virtnet_set_channels(struct n + + get_online_cpus(); + err = _virtnet_set_queues(vi, queue_pairs); +- if (!err) { +- netif_set_real_num_tx_queues(dev, queue_pairs); +- netif_set_real_num_rx_queues(dev, queue_pairs); +- +- virtnet_set_affinity(vi); ++ if (err) { ++ put_online_cpus(); ++ goto err; + } ++ virtnet_set_affinity(vi); + put_online_cpus(); + ++ netif_set_real_num_tx_queues(dev, queue_pairs); ++ netif_set_real_num_rx_queues(dev, queue_pairs); ++ err: + return err; + } +