From: Sasha Levin Date: Fri, 21 Jun 2024 15:39:28 +0000 (-0400) Subject: Fixes for 5.4 X-Git-Tag: v6.1.96~70 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=9bd0943b41d8fe7b4637ec5aa119c09602bb7c1e;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.4 Signed-off-by: Sasha Levin --- diff --git a/queue-5.4/batman-adv-bypass-empty-buckets-in-batadv_purge_orig.patch b/queue-5.4/batman-adv-bypass-empty-buckets-in-batadv_purge_orig.patch new file mode 100644 index 00000000000..e5f8bca7c03 --- /dev/null +++ b/queue-5.4/batman-adv-bypass-empty-buckets-in-batadv_purge_orig.patch @@ -0,0 +1,110 @@ +From 5d768c093bb3ab10b753c1e5fe161a91a40a6054 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 30 Mar 2024 15:54:38 +0000 +Subject: batman-adv: bypass empty buckets in batadv_purge_orig_ref() + +From: Eric Dumazet + +[ Upstream commit 40dc8ab605894acae1473e434944924a22cfaaa0 ] + +Many syzbot reports are pointing to soft lockups in +batadv_purge_orig_ref() [1] + +Root cause is unknown, but we can avoid spending too much +time there and perhaps get more interesting reports. + +[1] + +watchdog: BUG: soft lockup - CPU#0 stuck for 27s! [kworker/u4:6:621] +Modules linked in: +irq event stamp: 6182794 + hardirqs last enabled at (6182793): [] __local_bh_enable_ip+0x224/0x44c kernel/softirq.c:386 + hardirqs last disabled at (6182794): [] __el1_irq arch/arm64/kernel/entry-common.c:533 [inline] + hardirqs last disabled at (6182794): [] el1_interrupt+0x24/0x68 arch/arm64/kernel/entry-common.c:551 + softirqs last enabled at (6182792): [] spin_unlock_bh include/linux/spinlock.h:396 [inline] + softirqs last enabled at (6182792): [] batadv_purge_orig_ref+0x114c/0x1228 net/batman-adv/originator.c:1287 + softirqs last disabled at (6182790): [] spin_lock_bh include/linux/spinlock.h:356 [inline] + softirqs last disabled at (6182790): [] batadv_purge_orig_ref+0x164/0x1228 net/batman-adv/originator.c:1271 +CPU: 0 PID: 621 Comm: kworker/u4:6 Not tainted 6.8.0-rc7-syzkaller-g707081b61156 #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024 +Workqueue: bat_events batadv_purge_orig +pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) + pc : should_resched arch/arm64/include/asm/preempt.h:79 [inline] + pc : __local_bh_enable_ip+0x228/0x44c kernel/softirq.c:388 + lr : __local_bh_enable_ip+0x224/0x44c kernel/softirq.c:386 +sp : ffff800099007970 +x29: ffff800099007980 x28: 1fffe00018fce1bd x27: dfff800000000000 +x26: ffff0000d2620008 x25: ffff0000c7e70de8 x24: 0000000000000001 +x23: 1fffe00018e57781 x22: dfff800000000000 x21: ffff80008aab71c4 +x20: ffff0001b40136c0 x19: ffff0000c72bbc08 x18: 1fffe0001a817bb0 +x17: ffff800125414000 x16: ffff80008032116c x15: 0000000000000001 +x14: 1fffe0001ee9d610 x13: 0000000000000000 x12: 0000000000000003 +x11: 0000000000000000 x10: 0000000000ff0100 x9 : 0000000000000000 +x8 : 00000000005e5789 x7 : ffff80008aab61dc x6 : 0000000000000000 +x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000000 +x2 : 0000000000000006 x1 : 0000000000000080 x0 : ffff800125414000 +Call trace: + __daif_local_irq_enable arch/arm64/include/asm/irqflags.h:27 [inline] + arch_local_irq_enable arch/arm64/include/asm/irqflags.h:49 [inline] + __local_bh_enable_ip+0x228/0x44c kernel/softirq.c:386 + __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:167 [inline] + _raw_spin_unlock_bh+0x3c/0x4c kernel/locking/spinlock.c:210 + spin_unlock_bh include/linux/spinlock.h:396 [inline] + batadv_purge_orig_ref+0x114c/0x1228 net/batman-adv/originator.c:1287 + batadv_purge_orig+0x20/0x70 net/batman-adv/originator.c:1300 + process_one_work+0x694/0x1204 kernel/workqueue.c:2633 + process_scheduled_works kernel/workqueue.c:2706 [inline] + worker_thread+0x938/0xef4 kernel/workqueue.c:2787 + kthread+0x288/0x310 kernel/kthread.c:388 + ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860 +Sending NMI from CPU 0 to CPUs 1: +NMI backtrace for cpu 1 +CPU: 1 PID: 0 Comm: swapper/1 Not tainted 6.8.0-rc7-syzkaller-g707081b61156 #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024 +pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) + pc : arch_local_irq_enable+0x8/0xc arch/arm64/include/asm/irqflags.h:51 + lr : default_idle_call+0xf8/0x128 kernel/sched/idle.c:103 +sp : ffff800093a17d30 +x29: ffff800093a17d30 x28: dfff800000000000 x27: 1ffff00012742fb4 +x26: ffff80008ec9d000 x25: 0000000000000000 x24: 0000000000000002 +x23: 1ffff00011d93a74 x22: ffff80008ec9d3a0 x21: 0000000000000000 +x20: ffff0000c19dbc00 x19: ffff8000802d0fd8 x18: 1fffe00036804396 +x17: ffff80008ec9d000 x16: ffff8000802d089c x15: 0000000000000001 +x14: 1fffe00036805f10 x13: 0000000000000000 x12: 0000000000000003 +x11: 0000000000000001 x10: 0000000000000003 x9 : 0000000000000000 +x8 : 00000000000ce8d1 x7 : ffff8000804609e4 x6 : 0000000000000000 +x5 : 0000000000000001 x4 : 0000000000000001 x3 : ffff80008ad6aac0 +x2 : 0000000000000000 x1 : ffff80008aedea60 x0 : ffff800125436000 +Call trace: + __daif_local_irq_enable arch/arm64/include/asm/irqflags.h:27 [inline] + arch_local_irq_enable+0x8/0xc arch/arm64/include/asm/irqflags.h:49 + cpuidle_idle_call kernel/sched/idle.c:170 [inline] + do_idle+0x1f0/0x4e8 kernel/sched/idle.c:312 + cpu_startup_entry+0x5c/0x74 kernel/sched/idle.c:410 + secondary_start_kernel+0x198/0x1c0 arch/arm64/kernel/smp.c:272 + __secondary_switched+0xb8/0xbc arch/arm64/kernel/head.S:404 + +Signed-off-by: Eric Dumazet +Signed-off-by: Sven Eckelmann +Signed-off-by: Simon Wunderlich +Signed-off-by: Sasha Levin +--- + net/batman-adv/originator.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/batman-adv/originator.c b/net/batman-adv/originator.c +index 38613487fb1b7..ba51b69ee3642 100644 +--- a/net/batman-adv/originator.c ++++ b/net/batman-adv/originator.c +@@ -1345,6 +1345,8 @@ void batadv_purge_orig_ref(struct batadv_priv *bat_priv) + /* for all origins... */ + for (i = 0; i < hash->size; i++) { + head = &hash->table[i]; ++ if (hlist_empty(head)) ++ continue; + list_lock = &hash->list_locks[i]; + + spin_lock_bh(list_lock); +-- +2.43.0 + diff --git a/queue-5.4/bluetooth-ath3k-fix-multiple-issues-reported-by-chec.patch b/queue-5.4/bluetooth-ath3k-fix-multiple-issues-reported-by-chec.patch new file mode 100644 index 00000000000..73479f0fce6 --- /dev/null +++ b/queue-5.4/bluetooth-ath3k-fix-multiple-issues-reported-by-chec.patch @@ -0,0 +1,190 @@ +From 411ad41e12946d22c0d6c2ef8ae58a5b5366c6a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 6 Apr 2024 00:42:24 +0300 +Subject: Bluetooth: ath3k: Fix multiple issues reported by checkpatch.pl + +From: Uri Arev + +[ Upstream commit 68aa21054ec3a1a313af90a5f95ade16c3326d20 ] + +This fixes some CHECKs reported by the checkpatch script. + +Issues reported in ath3k.c: +------- +ath3k.c +------- +CHECK: Please don't use multiple blank lines ++ ++ + +CHECK: Blank lines aren't necessary after an open brace '{' ++static const struct usb_device_id ath3k_blist_tbl[] = { ++ + +CHECK: Alignment should match open parenthesis ++static int ath3k_load_firmware(struct usb_device *udev, ++ const struct firmware *firmware) + +CHECK: Alignment should match open parenthesis ++ err = usb_bulk_msg(udev, pipe, send_buf, size, ++ &len, 3000); + +CHECK: Unnecessary parentheses around 'len != size' ++ if (err || (len != size)) { + +CHECK: Alignment should match open parenthesis ++static int ath3k_get_version(struct usb_device *udev, ++ struct ath3k_version *version) + +CHECK: Alignment should match open parenthesis ++static int ath3k_load_fwfile(struct usb_device *udev, ++ const struct firmware *firmware) + +CHECK: Alignment should match open parenthesis ++ err = usb_bulk_msg(udev, pipe, send_buf, size, ++ &len, 3000); + +CHECK: Unnecessary parentheses around 'len != size' ++ if (err || (len != size)) { + +CHECK: Blank lines aren't necessary after an open brace '{' ++ switch (fw_version.ref_clock) { ++ + +CHECK: Alignment should match open parenthesis ++ snprintf(filename, ATH3K_NAME_LEN, "ar3k/ramps_0x%08x_%d%s", ++ le32_to_cpu(fw_version.rom_version), clk_value, ".dfu"); + +CHECK: Alignment should match open parenthesis ++static int ath3k_probe(struct usb_interface *intf, ++ const struct usb_device_id *id) + +CHECK: Alignment should match open parenthesis ++ BT_ERR("Firmware file \"%s\" not found", ++ ATH3K_FIRMWARE); + +CHECK: Alignment should match open parenthesis ++ BT_ERR("Firmware file \"%s\" request failed (err=%d)", ++ ATH3K_FIRMWARE, ret); + +total: 0 errors, 0 warnings, 14 checks, 540 lines checked + +Signed-off-by: Uri Arev +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/ath3k.c | 25 +++++++++++-------------- + 1 file changed, 11 insertions(+), 14 deletions(-) + +diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c +index 4ce2705136952..d108202d2ec19 100644 +--- a/drivers/bluetooth/ath3k.c ++++ b/drivers/bluetooth/ath3k.c +@@ -3,7 +3,6 @@ + * Copyright (c) 2008-2009 Atheros Communications Inc. + */ + +- + #include + #include + #include +@@ -129,7 +128,6 @@ MODULE_DEVICE_TABLE(usb, ath3k_table); + * for AR3012 + */ + static const struct usb_device_id ath3k_blist_tbl[] = { +- + /* Atheros AR3012 with sflash firmware*/ + { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 }, +@@ -203,7 +201,7 @@ static inline void ath3k_log_failed_loading(int err, int len, int size, + #define TIMEGAP_USEC_MAX 100 + + static int ath3k_load_firmware(struct usb_device *udev, +- const struct firmware *firmware) ++ const struct firmware *firmware) + { + u8 *send_buf; + int len = 0; +@@ -241,9 +239,9 @@ static int ath3k_load_firmware(struct usb_device *udev, + memcpy(send_buf, firmware->data + sent, size); + + err = usb_bulk_msg(udev, pipe, send_buf, size, +- &len, 3000); ++ &len, 3000); + +- if (err || (len != size)) { ++ if (err || len != size) { + ath3k_log_failed_loading(err, len, size, count); + goto error; + } +@@ -278,7 +276,7 @@ static int ath3k_get_state(struct usb_device *udev, unsigned char *state) + } + + static int ath3k_get_version(struct usb_device *udev, +- struct ath3k_version *version) ++ struct ath3k_version *version) + { + int ret, pipe = 0; + struct ath3k_version *buf; +@@ -300,7 +298,7 @@ static int ath3k_get_version(struct usb_device *udev, + } + + static int ath3k_load_fwfile(struct usb_device *udev, +- const struct firmware *firmware) ++ const struct firmware *firmware) + { + u8 *send_buf; + int len = 0; +@@ -341,8 +339,8 @@ static int ath3k_load_fwfile(struct usb_device *udev, + memcpy(send_buf, firmware->data + sent, size); + + err = usb_bulk_msg(udev, pipe, send_buf, size, +- &len, 3000); +- if (err || (len != size)) { ++ &len, 3000); ++ if (err || len != size) { + ath3k_log_failed_loading(err, len, size, count); + kfree(send_buf); + return err; +@@ -461,7 +459,6 @@ static int ath3k_load_syscfg(struct usb_device *udev) + } + + switch (fw_version.ref_clock) { +- + case ATH3K_XTAL_FREQ_26M: + clk_value = 26; + break; +@@ -477,7 +474,7 @@ static int ath3k_load_syscfg(struct usb_device *udev) + } + + snprintf(filename, ATH3K_NAME_LEN, "ar3k/ramps_0x%08x_%d%s", +- le32_to_cpu(fw_version.rom_version), clk_value, ".dfu"); ++ le32_to_cpu(fw_version.rom_version), clk_value, ".dfu"); + + ret = request_firmware(&firmware, filename, &udev->dev); + if (ret < 0) { +@@ -492,7 +489,7 @@ static int ath3k_load_syscfg(struct usb_device *udev) + } + + static int ath3k_probe(struct usb_interface *intf, +- const struct usb_device_id *id) ++ const struct usb_device_id *id) + { + const struct firmware *firmware; + struct usb_device *udev = interface_to_usbdev(intf); +@@ -541,10 +538,10 @@ static int ath3k_probe(struct usb_interface *intf, + if (ret < 0) { + if (ret == -ENOENT) + BT_ERR("Firmware file \"%s\" not found", +- ATH3K_FIRMWARE); ++ ATH3K_FIRMWARE); + else + BT_ERR("Firmware file \"%s\" request failed (err=%d)", +- ATH3K_FIRMWARE, ret); ++ ATH3K_FIRMWARE, ret); + return ret; + } + +-- +2.43.0 + diff --git a/queue-5.4/drop_monitor-replace-spin_lock-by-raw_spin_lock.patch b/queue-5.4/drop_monitor-replace-spin_lock-by-raw_spin_lock.patch new file mode 100644 index 00000000000..63077047819 --- /dev/null +++ b/queue-5.4/drop_monitor-replace-spin_lock-by-raw_spin_lock.patch @@ -0,0 +1,155 @@ +From 090c3a817d678d59bb30af1569bb869af0e088f1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Apr 2024 11:13:46 -0300 +Subject: drop_monitor: replace spin_lock by raw_spin_lock + +From: Wander Lairson Costa + +[ Upstream commit f1e197a665c2148ebc25fe09c53689e60afea195 ] + +trace_drop_common() is called with preemption disabled, and it acquires +a spin_lock. This is problematic for RT kernels because spin_locks are +sleeping locks in this configuration, which causes the following splat: + +BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48 +in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 449, name: rcuc/47 +preempt_count: 1, expected: 0 +RCU nest depth: 2, expected: 2 +5 locks held by rcuc/47/449: + #0: ff1100086ec30a60 ((softirq_ctrl.lock)){+.+.}-{2:2}, at: __local_bh_disable_ip+0x105/0x210 + #1: ffffffffb394a280 (rcu_read_lock){....}-{1:2}, at: rt_spin_lock+0xbf/0x130 + #2: ffffffffb394a280 (rcu_read_lock){....}-{1:2}, at: __local_bh_disable_ip+0x11c/0x210 + #3: ffffffffb394a160 (rcu_callback){....}-{0:0}, at: rcu_do_batch+0x360/0xc70 + #4: ff1100086ee07520 (&data->lock){+.+.}-{2:2}, at: trace_drop_common.constprop.0+0xb5/0x290 +irq event stamp: 139909 +hardirqs last enabled at (139908): [] _raw_spin_unlock_irqrestore+0x63/0x80 +hardirqs last disabled at (139909): [] trace_drop_common.constprop.0+0x26d/0x290 +softirqs last enabled at (139892): [] __local_bh_enable_ip+0x103/0x170 +softirqs last disabled at (139898): [] rcu_cpu_kthread+0x93/0x1f0 +Preemption disabled at: +[] rt_mutex_slowunlock+0xab/0x2e0 +CPU: 47 PID: 449 Comm: rcuc/47 Not tainted 6.9.0-rc2-rt1+ #7 +Hardware name: Dell Inc. PowerEdge R650/0Y2G81, BIOS 1.6.5 04/15/2022 +Call Trace: + + dump_stack_lvl+0x8c/0xd0 + dump_stack+0x14/0x20 + __might_resched+0x21e/0x2f0 + rt_spin_lock+0x5e/0x130 + ? trace_drop_common.constprop.0+0xb5/0x290 + ? skb_queue_purge_reason.part.0+0x1bf/0x230 + trace_drop_common.constprop.0+0xb5/0x290 + ? preempt_count_sub+0x1c/0xd0 + ? _raw_spin_unlock_irqrestore+0x4a/0x80 + ? __pfx_trace_drop_common.constprop.0+0x10/0x10 + ? rt_mutex_slowunlock+0x26a/0x2e0 + ? skb_queue_purge_reason.part.0+0x1bf/0x230 + ? __pfx_rt_mutex_slowunlock+0x10/0x10 + ? skb_queue_purge_reason.part.0+0x1bf/0x230 + trace_kfree_skb_hit+0x15/0x20 + trace_kfree_skb+0xe9/0x150 + kfree_skb_reason+0x7b/0x110 + skb_queue_purge_reason.part.0+0x1bf/0x230 + ? __pfx_skb_queue_purge_reason.part.0+0x10/0x10 + ? mark_lock.part.0+0x8a/0x520 +... + +trace_drop_common() also disables interrupts, but this is a minor issue +because we could easily replace it with a local_lock. + +Replace the spin_lock with raw_spin_lock to avoid sleeping in atomic +context. + +Signed-off-by: Wander Lairson Costa +Reported-by: Hu Chunyu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/core/drop_monitor.c | 20 ++++++++++---------- + 1 file changed, 10 insertions(+), 10 deletions(-) + +diff --git a/net/core/drop_monitor.c b/net/core/drop_monitor.c +index feb946c954b65..b37465af47e4b 100644 +--- a/net/core/drop_monitor.c ++++ b/net/core/drop_monitor.c +@@ -71,7 +71,7 @@ struct net_dm_hw_entries { + }; + + struct per_cpu_dm_data { +- spinlock_t lock; /* Protects 'skb', 'hw_entries' and ++ raw_spinlock_t lock; /* Protects 'skb', 'hw_entries' and + * 'send_timer' + */ + union { +@@ -165,9 +165,9 @@ static struct sk_buff *reset_per_cpu_data(struct per_cpu_dm_data *data) + err: + mod_timer(&data->send_timer, jiffies + HZ / 10); + out: +- spin_lock_irqsave(&data->lock, flags); ++ raw_spin_lock_irqsave(&data->lock, flags); + swap(data->skb, skb); +- spin_unlock_irqrestore(&data->lock, flags); ++ raw_spin_unlock_irqrestore(&data->lock, flags); + + if (skb) { + struct nlmsghdr *nlh = (struct nlmsghdr *)skb->data; +@@ -222,7 +222,7 @@ static void trace_drop_common(struct sk_buff *skb, void *location) + + local_irq_save(flags); + data = this_cpu_ptr(&dm_cpu_data); +- spin_lock(&data->lock); ++ raw_spin_lock(&data->lock); + dskb = data->skb; + + if (!dskb) +@@ -256,7 +256,7 @@ static void trace_drop_common(struct sk_buff *skb, void *location) + } + + out: +- spin_unlock_irqrestore(&data->lock, flags); ++ raw_spin_unlock_irqrestore(&data->lock, flags); + } + + static void trace_kfree_skb_hit(void *ignore, struct sk_buff *skb, void *location) +@@ -315,9 +315,9 @@ net_dm_hw_reset_per_cpu_data(struct per_cpu_dm_data *hw_data) + mod_timer(&hw_data->send_timer, jiffies + HZ / 10); + } + +- spin_lock_irqsave(&hw_data->lock, flags); ++ raw_spin_lock_irqsave(&hw_data->lock, flags); + swap(hw_data->hw_entries, hw_entries); +- spin_unlock_irqrestore(&hw_data->lock, flags); ++ raw_spin_unlock_irqrestore(&hw_data->lock, flags); + + return hw_entries; + } +@@ -445,7 +445,7 @@ net_dm_hw_summary_probe(struct sk_buff *skb, + int i; + + hw_data = this_cpu_ptr(&dm_hw_cpu_data); +- spin_lock_irqsave(&hw_data->lock, flags); ++ raw_spin_lock_irqsave(&hw_data->lock, flags); + hw_entries = hw_data->hw_entries; + + if (!hw_entries) +@@ -474,7 +474,7 @@ net_dm_hw_summary_probe(struct sk_buff *skb, + } + + out: +- spin_unlock_irqrestore(&hw_data->lock, flags); ++ raw_spin_unlock_irqrestore(&hw_data->lock, flags); + } + + static const struct net_dm_alert_ops net_dm_alert_summary_ops = { +@@ -1592,7 +1592,7 @@ static struct notifier_block dropmon_net_notifier = { + + static void __net_dm_cpu_data_init(struct per_cpu_dm_data *data) + { +- spin_lock_init(&data->lock); ++ raw_spin_lock_init(&data->lock); + skb_queue_head_init(&data->drop_queue); + u64_stats_init(&data->stats.syncp); + } +-- +2.43.0 + diff --git a/queue-5.4/mips-octeon-add-pcie-link-status-check.patch b/queue-5.4/mips-octeon-add-pcie-link-status-check.patch new file mode 100644 index 00000000000..d4c6b4bdd33 --- /dev/null +++ b/queue-5.4/mips-octeon-add-pcie-link-status-check.patch @@ -0,0 +1,55 @@ +From 328795b36973e8a778c52ea92f5e132304ea2621 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Mar 2024 23:22:00 +0800 +Subject: MIPS: Octeon: Add PCIe link status check + +From: Songyang Li + +[ Upstream commit 29b83a64df3b42c88c0338696feb6fdcd7f1f3b7 ] + +The standard PCIe configuration read-write interface is used to +access the configuration space of the peripheral PCIe devices +of the mips processor after the PCIe link surprise down, it can +generate kernel panic caused by "Data bus error". So it is +necessary to add PCIe link status check for system protection. +When the PCIe link is down or in training, assigning a value +of 0 to the configuration address can prevent read-write behavior +to the configuration space of peripheral PCIe devices, thereby +preventing kernel panic. + +Signed-off-by: Songyang Li +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/pci/pcie-octeon.c | 6 ++++++ + 1 file changed, 6 insertions(+) + mode change 100644 => 100755 arch/mips/pci/pcie-octeon.c + +diff --git a/arch/mips/pci/pcie-octeon.c b/arch/mips/pci/pcie-octeon.c +old mode 100644 +new mode 100755 +index d919a0d813a17..38de2a9c3cf1a +--- a/arch/mips/pci/pcie-octeon.c ++++ b/arch/mips/pci/pcie-octeon.c +@@ -230,12 +230,18 @@ static inline uint64_t __cvmx_pcie_build_config_addr(int pcie_port, int bus, + { + union cvmx_pcie_address pcie_addr; + union cvmx_pciercx_cfg006 pciercx_cfg006; ++ union cvmx_pciercx_cfg032 pciercx_cfg032; + + pciercx_cfg006.u32 = + cvmx_pcie_cfgx_read(pcie_port, CVMX_PCIERCX_CFG006(pcie_port)); + if ((bus <= pciercx_cfg006.s.pbnum) && (dev != 0)) + return 0; + ++ pciercx_cfg032.u32 = ++ cvmx_pcie_cfgx_read(pcie_port, CVMX_PCIERCX_CFG032(pcie_port)); ++ if ((pciercx_cfg032.s.dlla == 0) || (pciercx_cfg032.s.lt == 1)) ++ return 0; ++ + pcie_addr.u64 = 0; + pcie_addr.config.upper = 2; + pcie_addr.config.io = 1; +-- +2.43.0 + diff --git a/queue-5.4/pci-pm-avoid-d3cold-for-hp-pavilion-17-pc-1972-pcie-.patch b/queue-5.4/pci-pm-avoid-d3cold-for-hp-pavilion-17-pc-1972-pcie-.patch new file mode 100644 index 00000000000..86a169e1cfc --- /dev/null +++ b/queue-5.4/pci-pm-avoid-d3cold-for-hp-pavilion-17-pc-1972-pcie-.patch @@ -0,0 +1,71 @@ +From 207ff5babf927edb8b502a03192bd8a32bd676ae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Mar 2024 10:37:09 -0600 +Subject: PCI/PM: Avoid D3cold for HP Pavilion 17 PC/1972 PCIe Ports + +From: Mario Limonciello + +[ Upstream commit 256df20c590bf0e4d63ac69330cf23faddac3e08 ] + +Hewlett-Packard HP Pavilion 17 Notebook PC/1972 is an Intel Ivy Bridge +system with a muxless AMD Radeon dGPU. Attempting to use the dGPU fails +with the following sequence: + + ACPI Error: Aborting method \AMD3._ON due to previous error (AE_AML_LOOP_TIMEOUT) (20230628/psparse-529) + radeon 0000:01:00.0: not ready 1023ms after resume; waiting + radeon 0000:01:00.0: not ready 2047ms after resume; waiting + radeon 0000:01:00.0: not ready 4095ms after resume; waiting + radeon 0000:01:00.0: not ready 8191ms after resume; waiting + radeon 0000:01:00.0: not ready 16383ms after resume; waiting + radeon 0000:01:00.0: not ready 32767ms after resume; waiting + radeon 0000:01:00.0: not ready 65535ms after resume; giving up + radeon 0000:01:00.0: Unable to change power state from D3cold to D0, device inaccessible + +The issue is that the Root Port the dGPU is connected to can't handle the +transition from D3cold to D0 so the dGPU can't properly exit runtime PM. + +The existing logic in pci_bridge_d3_possible() checks for systems that are +newer than 2015 to decide that D3 is safe. This would nominally work for +an Ivy Bridge system (which was discontinued in 2015), but this system +appears to have continued to receive BIOS updates until 2017 and so this +existing logic doesn't appropriately capture it. + +Add the system to bridge_d3_blacklist to prevent D3cold from being used. + +Link: https://lore.kernel.org/r/20240307163709.323-1-mario.limonciello@amd.com +Reported-by: Eric Heintzmann +Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3229 +Signed-off-by: Mario Limonciello +Signed-off-by: Bjorn Helgaas +Tested-by: Eric Heintzmann +Signed-off-by: Sasha Levin +--- + drivers/pci/pci.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c +index 64c89b23e99f7..deafd229ef8b4 100644 +--- a/drivers/pci/pci.c ++++ b/drivers/pci/pci.c +@@ -2626,6 +2626,18 @@ static const struct dmi_system_id bridge_d3_blacklist[] = { + DMI_MATCH(DMI_BOARD_VERSION, "Continental Z2"), + }, + }, ++ { ++ /* ++ * Changing power state of root port dGPU is connected fails ++ * https://gitlab.freedesktop.org/drm/amd/-/issues/3229 ++ */ ++ .ident = "Hewlett-Packard HP Pavilion 17 Notebook PC/1972", ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "Hewlett-Packard"), ++ DMI_MATCH(DMI_BOARD_NAME, "1972"), ++ DMI_MATCH(DMI_BOARD_VERSION, "95.33"), ++ }, ++ }, + #endif + { } + }; +-- +2.43.0 + diff --git a/queue-5.4/powerpc-io-avoid-clang-null-pointer-arithmetic-warni.patch b/queue-5.4/powerpc-io-avoid-clang-null-pointer-arithmetic-warni.patch new file mode 100644 index 00000000000..df55e3ee710 --- /dev/null +++ b/queue-5.4/powerpc-io-avoid-clang-null-pointer-arithmetic-warni.patch @@ -0,0 +1,85 @@ +From 4de6886251945fa830113d94569c10e6c3cd7aa3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 May 2024 17:56:18 +1000 +Subject: powerpc/io: Avoid clang null pointer arithmetic warnings + +From: Michael Ellerman + +[ Upstream commit 03c0f2c2b2220fc9cf8785cd7b61d3e71e24a366 ] + +With -Wextra clang warns about pointer arithmetic using a null pointer. +When building with CONFIG_PCI=n, that triggers a warning in the IO +accessors, eg: + + In file included from linux/arch/powerpc/include/asm/io.h:672: + linux/arch/powerpc/include/asm/io-defs.h:23:1: warning: performing pointer arithmetic on a null pointer has undefined behavior [-Wnull-pointer-arithmetic] + 23 | DEF_PCI_AC_RET(inb, u8, (unsigned long port), (port), pio, port) + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + ... + linux/arch/powerpc/include/asm/io.h:591:53: note: expanded from macro '__do_inb' + 591 | #define __do_inb(port) readb((PCI_IO_ADDR)_IO_BASE + port); + | ~~~~~~~~~~~~~~~~~~~~~ ^ + +That is because when CONFIG_PCI=n, _IO_BASE is defined as 0. + +Although _IO_BASE is defined as plain 0, the cast (PCI_IO_ADDR) converts +it to void * before the addition with port happens. + +Instead the addition can be done first, and then the cast. The resulting +value will be the same, but avoids the warning, and also avoids void +pointer arithmetic which is apparently non-standard. + +Reported-by: Naresh Kamboju +Closes: https://lore.kernel.org/all/CA+G9fYtEh8zmq8k8wE-8RZwW-Qr927RLTn+KqGnq1F=ptaaNsA@mail.gmail.com +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20240503075619.394467-1-mpe@ellerman.id.au +Signed-off-by: Sasha Levin +--- + arch/powerpc/include/asm/io.h | 24 ++++++++++++------------ + 1 file changed, 12 insertions(+), 12 deletions(-) + +diff --git a/arch/powerpc/include/asm/io.h b/arch/powerpc/include/asm/io.h +index daba2d2a02a0b..e86516ff8f4b3 100644 +--- a/arch/powerpc/include/asm/io.h ++++ b/arch/powerpc/include/asm/io.h +@@ -542,12 +542,12 @@ __do_out_asm(_rec_outl, "stwbrx") + #define __do_inw(port) _rec_inw(port) + #define __do_inl(port) _rec_inl(port) + #else /* CONFIG_PPC32 */ +-#define __do_outb(val, port) writeb(val,(PCI_IO_ADDR)_IO_BASE+port); +-#define __do_outw(val, port) writew(val,(PCI_IO_ADDR)_IO_BASE+port); +-#define __do_outl(val, port) writel(val,(PCI_IO_ADDR)_IO_BASE+port); +-#define __do_inb(port) readb((PCI_IO_ADDR)_IO_BASE + port); +-#define __do_inw(port) readw((PCI_IO_ADDR)_IO_BASE + port); +-#define __do_inl(port) readl((PCI_IO_ADDR)_IO_BASE + port); ++#define __do_outb(val, port) writeb(val,(PCI_IO_ADDR)(_IO_BASE+port)); ++#define __do_outw(val, port) writew(val,(PCI_IO_ADDR)(_IO_BASE+port)); ++#define __do_outl(val, port) writel(val,(PCI_IO_ADDR)(_IO_BASE+port)); ++#define __do_inb(port) readb((PCI_IO_ADDR)(_IO_BASE + port)); ++#define __do_inw(port) readw((PCI_IO_ADDR)(_IO_BASE + port)); ++#define __do_inl(port) readl((PCI_IO_ADDR)(_IO_BASE + port)); + #endif /* !CONFIG_PPC32 */ + + #ifdef CONFIG_EEH +@@ -563,12 +563,12 @@ __do_out_asm(_rec_outl, "stwbrx") + #define __do_writesw(a, b, n) _outsw(PCI_FIX_ADDR(a),(b),(n)) + #define __do_writesl(a, b, n) _outsl(PCI_FIX_ADDR(a),(b),(n)) + +-#define __do_insb(p, b, n) readsb((PCI_IO_ADDR)_IO_BASE+(p), (b), (n)) +-#define __do_insw(p, b, n) readsw((PCI_IO_ADDR)_IO_BASE+(p), (b), (n)) +-#define __do_insl(p, b, n) readsl((PCI_IO_ADDR)_IO_BASE+(p), (b), (n)) +-#define __do_outsb(p, b, n) writesb((PCI_IO_ADDR)_IO_BASE+(p),(b),(n)) +-#define __do_outsw(p, b, n) writesw((PCI_IO_ADDR)_IO_BASE+(p),(b),(n)) +-#define __do_outsl(p, b, n) writesl((PCI_IO_ADDR)_IO_BASE+(p),(b),(n)) ++#define __do_insb(p, b, n) readsb((PCI_IO_ADDR)(_IO_BASE+(p)), (b), (n)) ++#define __do_insw(p, b, n) readsw((PCI_IO_ADDR)(_IO_BASE+(p)), (b), (n)) ++#define __do_insl(p, b, n) readsl((PCI_IO_ADDR)(_IO_BASE+(p)), (b), (n)) ++#define __do_outsb(p, b, n) writesb((PCI_IO_ADDR)(_IO_BASE+(p)),(b),(n)) ++#define __do_outsw(p, b, n) writesw((PCI_IO_ADDR)(_IO_BASE+(p)),(b),(n)) ++#define __do_outsl(p, b, n) writesl((PCI_IO_ADDR)(_IO_BASE+(p)),(b),(n)) + + #define __do_memset_io(addr, c, n) \ + _memset_io(PCI_FIX_ADDR(addr), c, n) +-- +2.43.0 + diff --git a/queue-5.4/powerpc-pseries-enforce-hcall-result-buffer-validity.patch b/queue-5.4/powerpc-pseries-enforce-hcall-result-buffer-validity.patch new file mode 100644 index 00000000000..c70f8e2188c --- /dev/null +++ b/queue-5.4/powerpc-pseries-enforce-hcall-result-buffer-validity.patch @@ -0,0 +1,82 @@ +From 0e0c70a3d96e2c1dce05348f2289bb911b4d3342 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Apr 2024 09:08:31 -0500 +Subject: powerpc/pseries: Enforce hcall result buffer validity and size + +From: Nathan Lynch + +[ Upstream commit ff2e185cf73df480ec69675936c4ee75a445c3e4 ] + +plpar_hcall(), plpar_hcall9(), and related functions expect callers to +provide valid result buffers of certain minimum size. Currently this +is communicated only through comments in the code and the compiler has +no idea. + +For example, if I write a bug like this: + + long retbuf[PLPAR_HCALL_BUFSIZE]; // should be PLPAR_HCALL9_BUFSIZE + plpar_hcall9(H_ALLOCATE_VAS_WINDOW, retbuf, ...); + +This compiles with no diagnostics emitted, but likely results in stack +corruption at runtime when plpar_hcall9() stores results past the end +of the array. (To be clear this is a contrived example and I have not +found a real instance yet.) + +To make this class of error less likely, we can use explicitly-sized +array parameters instead of pointers in the declarations for the hcall +APIs. When compiled with -Warray-bounds[1], the code above now +provokes a diagnostic like this: + +error: array argument is too small; +is of size 32, callee requires at least 72 [-Werror,-Warray-bounds] + 60 | plpar_hcall9(H_ALLOCATE_VAS_WINDOW, retbuf, + | ^ ~~~~~~ + +[1] Enabled for LLVM builds but not GCC for now. See commit + 0da6e5fd6c37 ("gcc: disable '-Warray-bounds' for gcc-13 too") and + related changes. + +Signed-off-by: Nathan Lynch +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20240408-pseries-hvcall-retbuf-v1-1-ebc73d7253cf@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/include/asm/hvcall.h | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/powerpc/include/asm/hvcall.h b/arch/powerpc/include/asm/hvcall.h +index 0826c4ed83770..c4a6dad1e605c 100644 +--- a/arch/powerpc/include/asm/hvcall.h ++++ b/arch/powerpc/include/asm/hvcall.h +@@ -403,7 +403,7 @@ long plpar_hcall_norets(unsigned long opcode, ...); + * Used for all but the craziest of phyp interfaces (see plpar_hcall9) + */ + #define PLPAR_HCALL_BUFSIZE 4 +-long plpar_hcall(unsigned long opcode, unsigned long *retbuf, ...); ++long plpar_hcall(unsigned long opcode, unsigned long retbuf[static PLPAR_HCALL_BUFSIZE], ...); + + /** + * plpar_hcall_raw: - Make a hypervisor call without calculating hcall stats +@@ -417,7 +417,7 @@ long plpar_hcall(unsigned long opcode, unsigned long *retbuf, ...); + * plpar_hcall, but plpar_hcall_raw works in real mode and does not + * calculate hypervisor call statistics. + */ +-long plpar_hcall_raw(unsigned long opcode, unsigned long *retbuf, ...); ++long plpar_hcall_raw(unsigned long opcode, unsigned long retbuf[static PLPAR_HCALL_BUFSIZE], ...); + + /** + * plpar_hcall9: - Make a pseries hypervisor call with up to 9 return arguments +@@ -428,8 +428,8 @@ long plpar_hcall_raw(unsigned long opcode, unsigned long *retbuf, ...); + * PLPAR_HCALL9_BUFSIZE to size the return argument buffer. + */ + #define PLPAR_HCALL9_BUFSIZE 9 +-long plpar_hcall9(unsigned long opcode, unsigned long *retbuf, ...); +-long plpar_hcall9_raw(unsigned long opcode, unsigned long *retbuf, ...); ++long plpar_hcall9(unsigned long opcode, unsigned long retbuf[static PLPAR_HCALL9_BUFSIZE], ...); ++long plpar_hcall9_raw(unsigned long opcode, unsigned long retbuf[static PLPAR_HCALL9_BUFSIZE], ...); + + struct hvcall_mpp_data { + unsigned long entitled_mem; +-- +2.43.0 + diff --git a/queue-5.4/rcutorture-fix-rcu_torture_one_read-pipe_count-overf.patch b/queue-5.4/rcutorture-fix-rcu_torture_one_read-pipe_count-overf.patch new file mode 100644 index 00000000000..e08451e19ea --- /dev/null +++ b/queue-5.4/rcutorture-fix-rcu_torture_one_read-pipe_count-overf.patch @@ -0,0 +1,39 @@ +From ade333e100aec394f067fa0d52c658c4eff29b73 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Mar 2024 19:21:47 -0800 +Subject: rcutorture: Fix rcu_torture_one_read() pipe_count overflow comment + +From: Paul E. McKenney + +[ Upstream commit 8b9b443fa860276822b25057cb3ff3b28734dec0 ] + +The "pipe_count > RCU_TORTURE_PIPE_LEN" check has a comment saying "Should +not happen, but...". This is only true when testing an RCU whose grace +periods are always long enough. This commit therefore fixes this comment. + +Reported-by: Linus Torvalds +Closes: https://lore.kernel.org/lkml/CAHk-=wi7rJ-eGq+xaxVfzFEgbL9tdf6Kc8Z89rCpfcQOKm74Tw@mail.gmail.com/ +Signed-off-by: Paul E. McKenney +Signed-off-by: Uladzislau Rezki (Sony) +Signed-off-by: Sasha Levin +--- + kernel/rcu/rcutorture.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/kernel/rcu/rcutorture.c b/kernel/rcu/rcutorture.c +index 3c9feca1eab17..aef4d01c4f61e 100644 +--- a/kernel/rcu/rcutorture.c ++++ b/kernel/rcu/rcutorture.c +@@ -1291,7 +1291,8 @@ static bool rcu_torture_one_read(struct torture_random_state *trsp) + preempt_disable(); + pipe_count = p->rtort_pipe_count; + if (pipe_count > RCU_TORTURE_PIPE_LEN) { +- /* Should not happen, but... */ ++ // Should not happen in a correct RCU implementation, ++ // happens quite often for torture_type=busted. + pipe_count = RCU_TORTURE_PIPE_LEN; + } + completed = cur_ops->get_gp_seq(); +-- +2.43.0 + diff --git a/queue-5.4/scsi-qedi-fix-crash-while-reading-debugfs-attribute.patch b/queue-5.4/scsi-qedi-fix-crash-while-reading-debugfs-attribute.patch new file mode 100644 index 00000000000..9173f48fc9b --- /dev/null +++ b/queue-5.4/scsi-qedi-fix-crash-while-reading-debugfs-attribute.patch @@ -0,0 +1,95 @@ +From e5689602528e2afea8ac4eef08cb3db1c81e9d63 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Apr 2024 12:51:55 +0530 +Subject: scsi: qedi: Fix crash while reading debugfs attribute + +From: Manish Rangankar + +[ Upstream commit 28027ec8e32ecbadcd67623edb290dad61e735b5 ] + +The qedi_dbg_do_not_recover_cmd_read() function invokes sprintf() directly +on a __user pointer, which results into the crash. + +To fix this issue, use a small local stack buffer for sprintf() and then +call simple_read_from_buffer(), which in turns make the copy_to_user() +call. + +BUG: unable to handle page fault for address: 00007f4801111000 +PGD 8000000864df6067 P4D 8000000864df6067 PUD 864df7067 PMD 846028067 PTE 0 +Oops: 0002 [#1] PREEMPT SMP PTI +Hardware name: HPE ProLiant DL380 Gen10/ProLiant DL380 Gen10, BIOS U30 06/15/2023 +RIP: 0010:memcpy_orig+0xcd/0x130 +RSP: 0018:ffffb7a18c3ffc40 EFLAGS: 00010202 +RAX: 00007f4801111000 RBX: 00007f4801111000 RCX: 000000000000000f +RDX: 000000000000000f RSI: ffffffffc0bfd7a0 RDI: 00007f4801111000 +RBP: ffffffffc0bfd7a0 R08: 725f746f6e5f6f64 R09: 3d7265766f636572 +R10: ffffb7a18c3ffd08 R11: 0000000000000000 R12: 00007f4881110fff +R13: 000000007fffffff R14: ffffb7a18c3ffca0 R15: ffffffffc0bfd7af +FS: 00007f480118a740(0000) GS:ffff98e38af00000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 00007f4801111000 CR3: 0000000864b8e001 CR4: 00000000007706e0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +PKRU: 55555554 +Call Trace: + + ? __die_body+0x1a/0x60 + ? page_fault_oops+0x183/0x510 + ? exc_page_fault+0x69/0x150 + ? asm_exc_page_fault+0x22/0x30 + ? memcpy_orig+0xcd/0x130 + vsnprintf+0x102/0x4c0 + sprintf+0x51/0x80 + qedi_dbg_do_not_recover_cmd_read+0x2f/0x50 [qedi 6bcfdeeecdea037da47069eca2ba717c84a77324] + full_proxy_read+0x50/0x80 + vfs_read+0xa5/0x2e0 + ? folio_add_new_anon_rmap+0x44/0xa0 + ? set_pte_at+0x15/0x30 + ? do_pte_missing+0x426/0x7f0 + ksys_read+0xa5/0xe0 + do_syscall_64+0x58/0x80 + ? __count_memcg_events+0x46/0x90 + ? count_memcg_event_mm+0x3d/0x60 + ? handle_mm_fault+0x196/0x2f0 + ? do_user_addr_fault+0x267/0x890 + ? exc_page_fault+0x69/0x150 + entry_SYSCALL_64_after_hwframe+0x72/0xdc +RIP: 0033:0x7f4800f20b4d + +Tested-by: Martin Hoyer +Reviewed-by: John Meneghini +Signed-off-by: Manish Rangankar +Link: https://lore.kernel.org/r/20240415072155.30840-1-mrangankar@marvell.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qedi/qedi_debugfs.c | 12 ++++-------- + 1 file changed, 4 insertions(+), 8 deletions(-) + +diff --git a/drivers/scsi/qedi/qedi_debugfs.c b/drivers/scsi/qedi/qedi_debugfs.c +index 42f5afb60055c..6e724f47ab9e8 100644 +--- a/drivers/scsi/qedi/qedi_debugfs.c ++++ b/drivers/scsi/qedi/qedi_debugfs.c +@@ -120,15 +120,11 @@ static ssize_t + qedi_dbg_do_not_recover_cmd_read(struct file *filp, char __user *buffer, + size_t count, loff_t *ppos) + { +- size_t cnt = 0; +- +- if (*ppos) +- return 0; ++ char buf[64]; ++ int len; + +- cnt = sprintf(buffer, "do_not_recover=%d\n", qedi_do_not_recover); +- cnt = min_t(int, count, cnt - *ppos); +- *ppos += cnt; +- return cnt; ++ len = sprintf(buf, "do_not_recover=%d\n", qedi_do_not_recover); ++ return simple_read_from_buffer(buffer, count, ppos, buf, len); + } + + static int +-- +2.43.0 + diff --git a/queue-5.4/selftests-bpf-prevent-client-connect-before-server-b.patch b/queue-5.4/selftests-bpf-prevent-client-connect-before-server-b.patch new file mode 100644 index 00000000000..97f47bde109 --- /dev/null +++ b/queue-5.4/selftests-bpf-prevent-client-connect-before-server-b.patch @@ -0,0 +1,82 @@ +From d7b19d64eb7c8b9c24d45b4bab4c631c86b073e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Mar 2024 10:59:11 +0000 +Subject: selftests/bpf: Prevent client connect before server bind in + test_tc_tunnel.sh + +From: Alessandro Carminati (Red Hat) + +[ Upstream commit f803bcf9208a2540acb4c32bdc3616673169f490 ] + +In some systems, the netcat server can incur in delay to start listening. +When this happens, the test can randomly fail in various points. +This is an example error message: + + # ip gre none gso + # encap 192.168.1.1 to 192.168.1.2, type gre, mac none len 2000 + # test basic connectivity + # Ncat: Connection refused. + +The issue stems from a race condition between the netcat client and server. +The test author had addressed this problem by implementing a sleep, which +I have removed in this patch. +This patch introduces a function capable of sleeping for up to two seconds. +However, it can terminate the waiting period early if the port is reported +to be listening. + +Signed-off-by: Alessandro Carminati (Red Hat) +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20240314105911.213411-1-alessandro.carminati@gmail.com +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/test_tc_tunnel.sh | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/bpf/test_tc_tunnel.sh b/tools/testing/selftests/bpf/test_tc_tunnel.sh +index 7c76b841b17bb..21bde60c95230 100755 +--- a/tools/testing/selftests/bpf/test_tc_tunnel.sh ++++ b/tools/testing/selftests/bpf/test_tc_tunnel.sh +@@ -71,7 +71,6 @@ cleanup() { + server_listen() { + ip netns exec "${ns2}" nc "${netcat_opt}" -l -p "${port}" > "${outfile}" & + server_pid=$! +- sleep 0.2 + } + + client_connect() { +@@ -92,6 +91,16 @@ verify_data() { + fi + } + ++wait_for_port() { ++ for i in $(seq 20); do ++ if ip netns exec "${ns2}" ss ${2:--4}OHntl | grep -q "$1"; then ++ return 0 ++ fi ++ sleep 0.1 ++ done ++ return 1 ++} ++ + set -e + + # no arguments: automated test, run all +@@ -183,6 +192,7 @@ setup + # basic communication works + echo "test basic connectivity" + server_listen ++wait_for_port ${port} ${netcat_opt} + client_connect + verify_data + +@@ -194,6 +204,7 @@ ip netns exec "${ns1}" tc filter add dev veth1 egress \ + section "encap_${tuntype}_${mac}" + echo "test bpf encap without decap (expect failure)" + server_listen ++wait_for_port ${port} ${netcat_opt} + ! client_connect + + if [[ "$tuntype" =~ "udp" ]]; then +-- +2.43.0 + diff --git a/queue-5.4/series b/queue-5.4/series index e82b2d3b2cc..122d2cdf6eb 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -106,3 +106,15 @@ i2c-core-provide-generic-definitions-for-bus-frequen.patch i2c-drivers-use-generic-definitions-for-bus-frequenc.patch i2c-designware-move-configuration-routines-to-respec.patch i2c-designware-fix-the-functionality-flags-of-the-sl.patch +rcutorture-fix-rcu_torture_one_read-pipe_count-overf.patch +selftests-bpf-prevent-client-connect-before-server-b.patch +batman-adv-bypass-empty-buckets-in-batadv_purge_orig.patch +drop_monitor-replace-spin_lock-by-raw_spin_lock.patch +scsi-qedi-fix-crash-while-reading-debugfs-attribute.patch +bluetooth-ath3k-fix-multiple-issues-reported-by-chec.patch +powerpc-pseries-enforce-hcall-result-buffer-validity.patch +powerpc-io-avoid-clang-null-pointer-arithmetic-warni.patch +usb-misc-uss720-check-for-incompatible-versions-of-t.patch +udf-udftime-prevent-overflow-in-udf_disk_stamp_to_ti.patch +pci-pm-avoid-d3cold-for-hp-pavilion-17-pc-1972-pcie-.patch +mips-octeon-add-pcie-link-status-check.patch diff --git a/queue-5.4/udf-udftime-prevent-overflow-in-udf_disk_stamp_to_ti.patch b/queue-5.4/udf-udftime-prevent-overflow-in-udf_disk_stamp_to_ti.patch new file mode 100644 index 00000000000..367a98ac031 --- /dev/null +++ b/queue-5.4/udf-udftime-prevent-overflow-in-udf_disk_stamp_to_ti.patch @@ -0,0 +1,54 @@ +From e413333073cf9b69087b4caf0210e85fcafb2d21 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Mar 2024 16:27:55 +0300 +Subject: udf: udftime: prevent overflow in udf_disk_stamp_to_time() + +From: Roman Smirnov + +[ Upstream commit 3b84adf460381169c085e4bc09e7b57e9e16db0a ] + +An overflow can occur in a situation where src.centiseconds +takes the value of 255. This situation is unlikely, but there +is no validation check anywere in the code. + +Found by Linux Verification Center (linuxtesting.org) with Svace. + +Suggested-by: Jan Kara +Signed-off-by: Roman Smirnov +Reviewed-by: Sergey Shtylyov +Signed-off-by: Jan Kara +Message-Id: <20240327132755.13945-1-r.smirnov@omp.ru> +Signed-off-by: Sasha Levin +--- + fs/udf/udftime.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/fs/udf/udftime.c b/fs/udf/udftime.c +index fce4ad976c8c2..26169b1f482c3 100644 +--- a/fs/udf/udftime.c ++++ b/fs/udf/udftime.c +@@ -60,13 +60,18 @@ udf_disk_stamp_to_time(struct timespec64 *dest, struct timestamp src) + dest->tv_sec = mktime64(year, src.month, src.day, src.hour, src.minute, + src.second); + dest->tv_sec -= offset * 60; +- dest->tv_nsec = 1000 * (src.centiseconds * 10000 + +- src.hundredsOfMicroseconds * 100 + src.microseconds); ++ + /* + * Sanitize nanosecond field since reportedly some filesystems are + * recorded with bogus sub-second values. + */ +- dest->tv_nsec %= NSEC_PER_SEC; ++ if (src.centiseconds < 100 && src.hundredsOfMicroseconds < 100 && ++ src.microseconds < 100) { ++ dest->tv_nsec = 1000 * (src.centiseconds * 10000 + ++ src.hundredsOfMicroseconds * 100 + src.microseconds); ++ } else { ++ dest->tv_nsec = 0; ++ } + } + + void +-- +2.43.0 + diff --git a/queue-5.4/usb-misc-uss720-check-for-incompatible-versions-of-t.patch b/queue-5.4/usb-misc-uss720-check-for-incompatible-versions-of-t.patch new file mode 100644 index 00000000000..11167b9297b --- /dev/null +++ b/queue-5.4/usb-misc-uss720-check-for-incompatible-versions-of-t.patch @@ -0,0 +1,75 @@ +From 96b0a886e078c8865aa6b3c7a259621a7f362ce9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Mar 2024 09:07:11 -0600 +Subject: usb: misc: uss720: check for incompatible versions of the Belkin + F5U002 + +From: Alex Henrie + +[ Upstream commit 3295f1b866bfbcabd625511968e8a5c541f9ab32 ] + +The incompatible device in my possession has a sticker that says +"F5U002 Rev 2" and "P80453-B", and lsusb identifies it as +"050d:0002 Belkin Components IEEE-1284 Controller". There is a bug +report from 2007 from Michael Trausch who was seeing the exact same +errors that I saw in 2024 trying to use this cable. + +Link: https://lore.kernel.org/all/46DE5830.9060401@trausch.us/ +Signed-off-by: Alex Henrie +Link: https://lore.kernel.org/r/20240326150723.99939-5-alexhenrie24@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/misc/uss720.c | 20 +++++++++++++------- + 1 file changed, 13 insertions(+), 7 deletions(-) + +diff --git a/drivers/usb/misc/uss720.c b/drivers/usb/misc/uss720.c +index 0be8efcda15d5..d972c09629397 100644 +--- a/drivers/usb/misc/uss720.c ++++ b/drivers/usb/misc/uss720.c +@@ -677,7 +677,7 @@ static int uss720_probe(struct usb_interface *intf, + struct parport_uss720_private *priv; + struct parport *pp; + unsigned char reg; +- int i; ++ int ret; + + dev_dbg(&intf->dev, "probe: vendor id 0x%x, device id 0x%x\n", + le16_to_cpu(usbdev->descriptor.idVendor), +@@ -688,8 +688,8 @@ static int uss720_probe(struct usb_interface *intf, + usb_put_dev(usbdev); + return -ENODEV; + } +- i = usb_set_interface(usbdev, intf->altsetting->desc.bInterfaceNumber, 2); +- dev_dbg(&intf->dev, "set interface result %d\n", i); ++ ret = usb_set_interface(usbdev, intf->altsetting->desc.bInterfaceNumber, 2); ++ dev_dbg(&intf->dev, "set interface result %d\n", ret); + + interface = intf->cur_altsetting; + +@@ -725,12 +725,18 @@ static int uss720_probe(struct usb_interface *intf, + set_1284_register(pp, 7, 0x00, GFP_KERNEL); + set_1284_register(pp, 6, 0x30, GFP_KERNEL); /* PS/2 mode */ + set_1284_register(pp, 2, 0x0c, GFP_KERNEL); +- /* debugging */ +- get_1284_register(pp, 0, ®, GFP_KERNEL); ++ ++ /* The Belkin F5U002 Rev 2 P80453-B USB parallel port adapter shares the ++ * device ID 050d:0002 with some other device that works with this ++ * driver, but it itself does not. Detect and handle the bad cable ++ * here. */ ++ ret = get_1284_register(pp, 0, ®, GFP_KERNEL); + dev_dbg(&intf->dev, "reg: %7ph\n", priv->reg); ++ if (ret < 0) ++ return ret; + +- i = usb_find_last_int_in_endpoint(interface, &epd); +- if (!i) { ++ ret = usb_find_last_int_in_endpoint(interface, &epd); ++ if (!ret) { + dev_dbg(&intf->dev, "epaddr %d interval %d\n", + epd->bEndpointAddress, epd->bInterval); + } +-- +2.43.0 +