From: Greg Kroah-Hartman Date: Sun, 22 Nov 2020 11:25:43 +0000 (+0100) Subject: 4.4-stable patches X-Git-Tag: v4.4.246~46 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=ab34b16011f7dd252ea133b5b978849a35027e96;p=thirdparty%2Fkernel%2Fstable-queue.git 4.4-stable patches added patches: ah6-fix-error-return-code-in-ah6_input.patch atm-nicstar-unmap-dma-on-send-error.patch net-b44-fix-error-return-code-in-b44_init_one.patch net-bridge-add-missing-counters-to-ndo_get_stats64-callback.patch net-have-netpoll-bring-up-dsa-management-interface.patch net-mlx4_core-fix-init_hca-fields-offset.patch net-usb-qmi_wwan-set-dtr-quirk-for-mr400.patch net-x25-increase-refcnt-of-struct-x25_neigh-in-x25_rx_call_request.patch netlabel-fix-an-uninitialized-warning-in-netlbl_unlabel_staticlist.patch netlabel-fix-our-progress-tracking-in-netlbl_unlabel_staticlist.patch qlcnic-fix-error-return-code-in-qlcnic_83xx_restart_hw.patch sctp-change-to-hold-put-transport-for-proto_unreach_timer.patch --- diff --git a/queue-4.4/ah6-fix-error-return-code-in-ah6_input.patch b/queue-4.4/ah6-fix-error-return-code-in-ah6_input.patch new file mode 100644 index 00000000000..07cbb09917f --- /dev/null +++ b/queue-4.4/ah6-fix-error-return-code-in-ah6_input.patch @@ -0,0 +1,34 @@ +From foo@baz Sun Nov 22 12:23:07 PM CET 2020 +From: Zhang Changzhong +Date: Tue, 17 Nov 2020 10:45:05 +0800 +Subject: ah6: fix error return code in ah6_input() + +From: Zhang Changzhong + +[ Upstream commit a5ebcbdf34b65fcc07f38eaf2d60563b42619a59 ] + +Fix to return a negative error code from the error handling +case instead of 0, as done elsewhere in this function. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Reported-by: Hulk Robot +Signed-off-by: Zhang Changzhong +Link: https://lore.kernel.org/r/1605581105-35295-1-git-send-email-zhangchangzhong@huawei.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/ah6.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/net/ipv6/ah6.c ++++ b/net/ipv6/ah6.c +@@ -595,7 +595,8 @@ static int ah6_input(struct xfrm_state * + memcpy(auth_data, ah->auth_data, ahp->icv_trunc_len); + memset(ah->auth_data, 0, ahp->icv_trunc_len); + +- if (ipv6_clear_mutable_options(ip6h, hdr_len, XFRM_POLICY_IN)) ++ err = ipv6_clear_mutable_options(ip6h, hdr_len, XFRM_POLICY_IN); ++ if (err) + goto out_free; + + ip6h->priority = 0; diff --git a/queue-4.4/atm-nicstar-unmap-dma-on-send-error.patch b/queue-4.4/atm-nicstar-unmap-dma-on-send-error.patch new file mode 100644 index 00000000000..b4f394d998d --- /dev/null +++ b/queue-4.4/atm-nicstar-unmap-dma-on-send-error.patch @@ -0,0 +1,35 @@ +From foo@baz Sun Nov 22 12:23:07 PM CET 2020 +From: Sebastian Andrzej Siewior +Date: Mon, 16 Nov 2020 17:21:14 +0100 +Subject: atm: nicstar: Unmap DMA on send error + +From: Sebastian Andrzej Siewior + +[ Upstream commit 6dceaa9f56e22d0f9b4c4ad2ed9e04e315ce7fe5 ] + +The `skb' is mapped for DMA in ns_send() but does not unmap DMA in case +push_scqe() fails to submit the `skb'. The memory of the `skb' is +released so only the DMA mapping is leaking. + +Unmap the DMA mapping in case push_scqe() failed. + +Fixes: 864a3ff635fa7 ("atm: [nicstar] remove virt_to_bus() and support 64-bit platforms") +Cc: Chas Williams <3chas3@gmail.com> +Signed-off-by: Sebastian Andrzej Siewior +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/atm/nicstar.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/atm/nicstar.c ++++ b/drivers/atm/nicstar.c +@@ -1704,6 +1704,8 @@ static int ns_send(struct atm_vcc *vcc, + + if (push_scqe(card, vc, scq, &scqe, skb) != 0) { + atomic_inc(&vcc->stats->tx_err); ++ dma_unmap_single(&card->pcidev->dev, NS_PRV_DMA(skb), skb->len, ++ DMA_TO_DEVICE); + dev_kfree_skb_any(skb); + return -EIO; + } diff --git a/queue-4.4/net-b44-fix-error-return-code-in-b44_init_one.patch b/queue-4.4/net-b44-fix-error-return-code-in-b44_init_one.patch new file mode 100644 index 00000000000..e6f5c613628 --- /dev/null +++ b/queue-4.4/net-b44-fix-error-return-code-in-b44_init_one.patch @@ -0,0 +1,35 @@ +From foo@baz Sun Nov 22 12:23:07 PM CET 2020 +From: Zhang Changzhong +Date: Tue, 17 Nov 2020 11:02:11 +0800 +Subject: net: b44: fix error return code in b44_init_one() + +From: Zhang Changzhong + +[ Upstream commit 7b027c249da54f492699c43e26cba486cfd48035 ] + +Fix to return a negative error code from the error handling +case instead of 0, as done elsewhere in this function. + +Fixes: 39a6f4bce6b4 ("b44: replace the ssb_dma API with the generic DMA API") +Reported-by: Hulk Robot +Signed-off-by: Zhang Changzhong +Reviewed-by: Michael Chan +Link: https://lore.kernel.org/r/1605582131-36735-1-git-send-email-zhangchangzhong@huawei.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/broadcom/b44.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/broadcom/b44.c ++++ b/drivers/net/ethernet/broadcom/b44.c +@@ -2393,7 +2393,8 @@ static int b44_init_one(struct ssb_devic + goto err_out_free_dev; + } + +- if (dma_set_mask_and_coherent(sdev->dma_dev, DMA_BIT_MASK(30))) { ++ err = dma_set_mask_and_coherent(sdev->dma_dev, DMA_BIT_MASK(30)); ++ if (err) { + dev_err(sdev->dev, + "Required 30BIT DMA mask unsupported by the system\n"); + goto err_out_powerdown; diff --git a/queue-4.4/net-bridge-add-missing-counters-to-ndo_get_stats64-callback.patch b/queue-4.4/net-bridge-add-missing-counters-to-ndo_get_stats64-callback.patch new file mode 100644 index 00000000000..66ea4aec0a9 --- /dev/null +++ b/queue-4.4/net-bridge-add-missing-counters-to-ndo_get_stats64-callback.patch @@ -0,0 +1,32 @@ +From foo@baz Sun Nov 22 12:23:07 PM CET 2020 +From: Heiner Kallweit +Date: Fri, 13 Nov 2020 10:27:27 +0100 +Subject: net: bridge: add missing counters to ndo_get_stats64 callback + +From: Heiner Kallweit + +[ Upstream commit 7a30ecc9237681bb125cbd30eee92bef7e86293d ] + +In br_forward.c and br_input.c fields dev->stats.tx_dropped and +dev->stats.multicast are populated, but they are ignored in +ndo_get_stats64. + +Fixes: 28172739f0a2 ("net: fix 64 bit counters on 32 bit arches") +Signed-off-by: Heiner Kallweit +Link: https://lore.kernel.org/r/58ea9963-77ad-a7cf-8dfd-fc95ab95f606@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/bridge/br_device.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/net/bridge/br_device.c ++++ b/net/bridge/br_device.c +@@ -166,6 +166,7 @@ static struct rtnl_link_stats64 *br_get_ + sum.rx_packets += tmp.rx_packets; + } + ++ netdev_stats_to_stats64(stats, &dev->stats); + stats->tx_bytes = sum.tx_bytes; + stats->tx_packets = sum.tx_packets; + stats->rx_bytes = sum.rx_bytes; diff --git a/queue-4.4/net-have-netpoll-bring-up-dsa-management-interface.patch b/queue-4.4/net-have-netpoll-bring-up-dsa-management-interface.patch new file mode 100644 index 00000000000..c653a71a9f5 --- /dev/null +++ b/queue-4.4/net-have-netpoll-bring-up-dsa-management-interface.patch @@ -0,0 +1,81 @@ +From foo@baz Sun Nov 22 12:23:07 PM CET 2020 +From: Florian Fainelli +Date: Mon, 16 Nov 2020 19:52:34 -0800 +Subject: net: Have netpoll bring-up DSA management interface + +From: Florian Fainelli + +[ Upstream commit 1532b9778478577152201adbafa7738b1e844868 ] + +DSA network devices rely on having their DSA management interface up and +running otherwise their ndo_open() will return -ENETDOWN. Without doing +this it would not be possible to use DSA devices as netconsole when +configured on the command line. These devices also do not utilize the +upper/lower linking so the check about the netpoll device having upper +is not going to be a problem. + +The solution adopted here is identical to the one done for +net/ipv4/ipconfig.c with 728c02089a0e ("net: ipv4: handle DSA enabled +master network devices"), with the network namespace scope being +restricted to that of the process configuring netpoll. + +Fixes: 04ff53f96a93 ("net: dsa: Add netconsole support") +Tested-by: Vladimir Oltean +Signed-off-by: Florian Fainelli +Link: https://lore.kernel.org/r/20201117035236.22658-1-f.fainelli@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/core/netpoll.c | 22 ++++++++++++++++++---- + 1 file changed, 18 insertions(+), 4 deletions(-) + +--- a/net/core/netpoll.c ++++ b/net/core/netpoll.c +@@ -28,6 +28,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -661,15 +662,15 @@ EXPORT_SYMBOL_GPL(__netpoll_setup); + + int netpoll_setup(struct netpoll *np) + { +- struct net_device *ndev = NULL; ++ struct net_device *ndev = NULL, *dev = NULL; ++ struct net *net = current->nsproxy->net_ns; + struct in_device *in_dev; + int err; + + rtnl_lock(); +- if (np->dev_name) { +- struct net *net = current->nsproxy->net_ns; +++ if (np->dev_name) + ndev = __dev_get_by_name(net, np->dev_name); +- } ++ + if (!ndev) { + np_err(np, "%s doesn't exist, aborting\n", np->dev_name); + err = -ENODEV; +@@ -677,6 +678,19 @@ int netpoll_setup(struct netpoll *np) + } + dev_hold(ndev); + ++ /* bring up DSA management network devices up first */ ++ for_each_netdev(net, dev) { ++ if (!netdev_uses_dsa(dev)) ++ continue; ++ ++ err = dev_change_flags(dev, dev->flags | IFF_UP); ++ if (err < 0) { ++ np_err(np, "%s failed to open %s\n", ++ np->dev_name, dev->name); ++ goto put; ++ } ++ } ++ + if (netdev_master_upper_dev_get(ndev)) { + np_err(np, "%s is a slave device, aborting\n", np->dev_name); + err = -EBUSY; diff --git a/queue-4.4/net-mlx4_core-fix-init_hca-fields-offset.patch b/queue-4.4/net-mlx4_core-fix-init_hca-fields-offset.patch new file mode 100644 index 00000000000..e58232227db --- /dev/null +++ b/queue-4.4/net-mlx4_core-fix-init_hca-fields-offset.patch @@ -0,0 +1,67 @@ +From foo@baz Sun Nov 22 12:23:07 PM CET 2020 +From: Aya Levin +Date: Wed, 18 Nov 2020 10:19:22 +0200 +Subject: net/mlx4_core: Fix init_hca fields offset + +From: Aya Levin + +[ Upstream commit 6d9c8d15af0ef20a66a0b432cac0d08319920602 ] + +Slave function read the following capabilities from the wrong offset: +1. log_mc_entry_sz +2. fs_log_entry_sz +3. log_mc_hash_sz + +Fix that by adjusting these capabilities offset to match firmware +layout. + +Due to the wrong offset read, the following issues might occur: +1+2. Negative value reported at max_mcast_qp_attach. +3. Driver to init FW with multicast hash size of zero. + +Fixes: a40ded604365 ("net/mlx4_core: Add masking for a few queries on HCA caps") +Signed-off-by: Aya Levin +Reviewed-by: Moshe Shemesh +Reviewed-by: Eran Ben Elisha +Signed-off-by: Tariq Toukan +Link: https://lore.kernel.org/r/20201118081922.553-1-tariqt@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/mellanox/mlx4/fw.c | 6 +++--- + drivers/net/ethernet/mellanox/mlx4/fw.h | 4 ++-- + 2 files changed, 5 insertions(+), 5 deletions(-) + +--- a/drivers/net/ethernet/mellanox/mlx4/fw.c ++++ b/drivers/net/ethernet/mellanox/mlx4/fw.c +@@ -1711,14 +1711,14 @@ int mlx4_INIT_HCA(struct mlx4_dev *dev, + #define INIT_HCA_LOG_RD_OFFSET (INIT_HCA_QPC_OFFSET + 0x77) + #define INIT_HCA_MCAST_OFFSET 0x0c0 + #define INIT_HCA_MC_BASE_OFFSET (INIT_HCA_MCAST_OFFSET + 0x00) +-#define INIT_HCA_LOG_MC_ENTRY_SZ_OFFSET (INIT_HCA_MCAST_OFFSET + 0x12) +-#define INIT_HCA_LOG_MC_HASH_SZ_OFFSET (INIT_HCA_MCAST_OFFSET + 0x16) ++#define INIT_HCA_LOG_MC_ENTRY_SZ_OFFSET (INIT_HCA_MCAST_OFFSET + 0x13) ++#define INIT_HCA_LOG_MC_HASH_SZ_OFFSET (INIT_HCA_MCAST_OFFSET + 0x17) + #define INIT_HCA_UC_STEERING_OFFSET (INIT_HCA_MCAST_OFFSET + 0x18) + #define INIT_HCA_LOG_MC_TABLE_SZ_OFFSET (INIT_HCA_MCAST_OFFSET + 0x1b) + #define INIT_HCA_DEVICE_MANAGED_FLOW_STEERING_EN 0x6 + #define INIT_HCA_FS_PARAM_OFFSET 0x1d0 + #define INIT_HCA_FS_BASE_OFFSET (INIT_HCA_FS_PARAM_OFFSET + 0x00) +-#define INIT_HCA_FS_LOG_ENTRY_SZ_OFFSET (INIT_HCA_FS_PARAM_OFFSET + 0x12) ++#define INIT_HCA_FS_LOG_ENTRY_SZ_OFFSET (INIT_HCA_FS_PARAM_OFFSET + 0x13) + #define INIT_HCA_FS_A0_OFFSET (INIT_HCA_FS_PARAM_OFFSET + 0x18) + #define INIT_HCA_FS_LOG_TABLE_SZ_OFFSET (INIT_HCA_FS_PARAM_OFFSET + 0x1b) + #define INIT_HCA_FS_ETH_BITS_OFFSET (INIT_HCA_FS_PARAM_OFFSET + 0x21) +--- a/drivers/net/ethernet/mellanox/mlx4/fw.h ++++ b/drivers/net/ethernet/mellanox/mlx4/fw.h +@@ -184,8 +184,8 @@ struct mlx4_init_hca_param { + u64 cmpt_base; + u64 mtt_base; + u64 global_caps; +- u16 log_mc_entry_sz; +- u16 log_mc_hash_sz; ++ u8 log_mc_entry_sz; ++ u8 log_mc_hash_sz; + u16 hca_core_clock; /* Internal Clock Frequency (in MHz) */ + u8 log_num_qps; + u8 log_num_srqs; diff --git a/queue-4.4/net-usb-qmi_wwan-set-dtr-quirk-for-mr400.patch b/queue-4.4/net-usb-qmi_wwan-set-dtr-quirk-for-mr400.patch new file mode 100644 index 00000000000..eb54aca9661 --- /dev/null +++ b/queue-4.4/net-usb-qmi_wwan-set-dtr-quirk-for-mr400.patch @@ -0,0 +1,31 @@ +From foo@baz Sun Nov 22 12:23:07 PM CET 2020 +From: Filip Moc +Date: Tue, 17 Nov 2020 18:36:31 +0100 +Subject: net: usb: qmi_wwan: Set DTR quirk for MR400 + +From: Filip Moc + +[ Upstream commit df8d85d8c69d6837817e54dcb73c84a8b5a13877 ] + +LTE module MR400 embedded in TL-MR6400 v4 requires DTR to be set. + +Signed-off-by: Filip Moc +Acked-by: Bjørn Mork +Link: https://lore.kernel.org/r/20201117173631.GA550981@moc6.cz +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/usb/qmi_wwan.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -702,7 +702,7 @@ static const struct usb_device_id produc + {QMI_FIXED_INTF(0x05c6, 0x9011, 4)}, + {QMI_FIXED_INTF(0x05c6, 0x9021, 1)}, + {QMI_FIXED_INTF(0x05c6, 0x9022, 2)}, +- {QMI_FIXED_INTF(0x05c6, 0x9025, 4)}, /* Alcatel-sbell ASB TL131 TDD LTE (China Mobile) */ ++ {QMI_QUIRK_SET_DTR(0x05c6, 0x9025, 4)}, /* Alcatel-sbell ASB TL131 TDD LTE (China Mobile) */ + {QMI_FIXED_INTF(0x05c6, 0x9026, 3)}, + {QMI_FIXED_INTF(0x05c6, 0x902e, 5)}, + {QMI_FIXED_INTF(0x05c6, 0x9031, 5)}, diff --git a/queue-4.4/net-x25-increase-refcnt-of-struct-x25_neigh-in-x25_rx_call_request.patch b/queue-4.4/net-x25-increase-refcnt-of-struct-x25_neigh-in-x25_rx_call_request.patch new file mode 100644 index 00000000000..1b15459106b --- /dev/null +++ b/queue-4.4/net-x25-increase-refcnt-of-struct-x25_neigh-in-x25_rx_call_request.patch @@ -0,0 +1,41 @@ +From foo@baz Sun Nov 22 12:23:07 PM CET 2020 +From: Xie He +Date: Thu, 12 Nov 2020 02:35:06 -0800 +Subject: net: x25: Increase refcnt of "struct x25_neigh" in x25_rx_call_request + +From: Xie He + +[ Upstream commit 4ee18c179e5e815fa5575e0d2db0c05795a804ee ] + +The x25_disconnect function in x25_subr.c would decrease the refcount of +"x25->neighbour" (struct x25_neigh) and reset this pointer to NULL. + +However, the x25_rx_call_request function in af_x25.c, which is called +when we receive a connection request, does not increase the refcount when +it assigns the pointer. + +Fix this issue by increasing the refcount of "struct x25_neigh" in +x25_rx_call_request. + +This patch fixes frequent kernel crashes when using AF_X25 sockets. + +Fixes: 4becb7ee5b3d ("net/x25: Fix x25_neigh refcnt leak when x25 disconnect") +Cc: Martin Schiller +Signed-off-by: Xie He +Link: https://lore.kernel.org/r/20201112103506.5875-1-xie.he.0141@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/x25/af_x25.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/net/x25/af_x25.c ++++ b/net/x25/af_x25.c +@@ -1047,6 +1047,7 @@ int x25_rx_call_request(struct sk_buff * + makex25->lci = lci; + makex25->dest_addr = dest_addr; + makex25->source_addr = source_addr; ++ x25_neigh_hold(nb); + makex25->neighbour = nb; + makex25->facilities = facilities; + makex25->dte_facilities= dte_facilities; diff --git a/queue-4.4/netlabel-fix-an-uninitialized-warning-in-netlbl_unlabel_staticlist.patch b/queue-4.4/netlabel-fix-an-uninitialized-warning-in-netlbl_unlabel_staticlist.patch new file mode 100644 index 00000000000..456c2b24541 --- /dev/null +++ b/queue-4.4/netlabel-fix-an-uninitialized-warning-in-netlbl_unlabel_staticlist.patch @@ -0,0 +1,35 @@ +From foo@baz Sun Nov 22 12:23:07 PM CET 2020 +From: Paul Moore +Date: Fri, 13 Nov 2020 16:30:40 -0500 +Subject: netlabel: fix an uninitialized warning in netlbl_unlabel_staticlist() + +From: Paul Moore + +[ Upstream commit 1ba86d4366e023d96df3dbe415eea7f1dc08c303 ] + +Static checking revealed that a previous fix to +netlbl_unlabel_staticlist() leaves a stack variable uninitialized, +this patches fixes that. + +Fixes: 866358ec331f ("netlabel: fix our progress tracking in netlbl_unlabel_staticlist()") +Reported-by: Dan Carpenter +Signed-off-by: Paul Moore +Reviewed-by: James Morris +Link: https://lore.kernel.org/r/160530304068.15651.18355773009751195447.stgit@sifl +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/netlabel/netlabel_unlabeled.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/netlabel/netlabel_unlabeled.c ++++ b/net/netlabel/netlabel_unlabeled.c +@@ -1186,7 +1186,7 @@ static int netlbl_unlabel_staticlist(str + u32 skip_bkt = cb->args[0]; + u32 skip_chain = cb->args[1]; + u32 skip_addr4 = cb->args[2]; +- u32 iter_bkt, iter_chain, iter_addr4 = 0, iter_addr6 = 0; ++ u32 iter_bkt, iter_chain = 0, iter_addr4 = 0, iter_addr6 = 0; + struct netlbl_unlhsh_iface *iface; + struct list_head *iter_list; + struct netlbl_af4list *addr4; diff --git a/queue-4.4/netlabel-fix-our-progress-tracking-in-netlbl_unlabel_staticlist.patch b/queue-4.4/netlabel-fix-our-progress-tracking-in-netlbl_unlabel_staticlist.patch new file mode 100644 index 00000000000..ef007a24a0e --- /dev/null +++ b/queue-4.4/netlabel-fix-our-progress-tracking-in-netlbl_unlabel_staticlist.patch @@ -0,0 +1,89 @@ +From foo@baz Sun Nov 22 12:23:07 PM CET 2020 +From: Paul Moore +Date: Sun, 8 Nov 2020 09:08:26 -0500 +Subject: netlabel: fix our progress tracking in netlbl_unlabel_staticlist() + +From: Paul Moore + +[ Upstream commit 866358ec331f8faa394995fb4b511af1db0247c8 ] + +The current NetLabel code doesn't correctly keep track of the netlink +dump state in some cases, in particular when multiple interfaces with +large configurations are loaded. The problem manifests itself by not +reporting the full configuration to userspace, even though it is +loaded and active in the kernel. This patch fixes this by ensuring +that the dump state is properly reset when necessary inside the +netlbl_unlabel_staticlist() function. + +Fixes: 8cc44579d1bd ("NetLabel: Introduce static network labels for unlabeled connections") +Signed-off-by: Paul Moore +Link: https://lore.kernel.org/r/160484450633.3752.16512718263560813473.stgit@sifl +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/netlabel/netlabel_unlabeled.c | 17 ++++++++++++----- + 1 file changed, 12 insertions(+), 5 deletions(-) + +--- a/net/netlabel/netlabel_unlabeled.c ++++ b/net/netlabel/netlabel_unlabeled.c +@@ -1185,12 +1185,13 @@ static int netlbl_unlabel_staticlist(str + struct netlbl_unlhsh_walk_arg cb_arg; + u32 skip_bkt = cb->args[0]; + u32 skip_chain = cb->args[1]; +- u32 iter_bkt; +- u32 iter_chain = 0, iter_addr4 = 0, iter_addr6 = 0; ++ u32 skip_addr4 = cb->args[2]; ++ u32 iter_bkt, iter_chain, iter_addr4 = 0, iter_addr6 = 0; + struct netlbl_unlhsh_iface *iface; + struct list_head *iter_list; + struct netlbl_af4list *addr4; + #if IS_ENABLED(CONFIG_IPV6) ++ u32 skip_addr6 = cb->args[3]; + struct netlbl_af6list *addr6; + #endif + +@@ -1201,7 +1202,7 @@ static int netlbl_unlabel_staticlist(str + rcu_read_lock(); + for (iter_bkt = skip_bkt; + iter_bkt < rcu_dereference(netlbl_unlhsh)->size; +- iter_bkt++, iter_chain = 0, iter_addr4 = 0, iter_addr6 = 0) { ++ iter_bkt++) { + iter_list = &rcu_dereference(netlbl_unlhsh)->tbl[iter_bkt]; + list_for_each_entry_rcu(iface, iter_list, list) { + if (!iface->valid || +@@ -1209,7 +1210,7 @@ static int netlbl_unlabel_staticlist(str + continue; + netlbl_af4list_foreach_rcu(addr4, + &iface->addr4_list) { +- if (iter_addr4++ < cb->args[2]) ++ if (iter_addr4++ < skip_addr4) + continue; + if (netlbl_unlabel_staticlist_gen( + NLBL_UNLABEL_C_STATICLIST, +@@ -1222,10 +1223,12 @@ static int netlbl_unlabel_staticlist(str + goto unlabel_staticlist_return; + } + } ++ iter_addr4 = 0; ++ skip_addr4 = 0; + #if IS_ENABLED(CONFIG_IPV6) + netlbl_af6list_foreach_rcu(addr6, + &iface->addr6_list) { +- if (iter_addr6++ < cb->args[3]) ++ if (iter_addr6++ < skip_addr6) + continue; + if (netlbl_unlabel_staticlist_gen( + NLBL_UNLABEL_C_STATICLIST, +@@ -1238,8 +1241,12 @@ static int netlbl_unlabel_staticlist(str + goto unlabel_staticlist_return; + } + } ++ iter_addr6 = 0; ++ skip_addr6 = 0; + #endif /* IPv6 */ + } ++ iter_chain = 0; ++ skip_chain = 0; + } + + unlabel_staticlist_return: diff --git a/queue-4.4/qlcnic-fix-error-return-code-in-qlcnic_83xx_restart_hw.patch b/queue-4.4/qlcnic-fix-error-return-code-in-qlcnic_83xx_restart_hw.patch new file mode 100644 index 00000000000..ce23f35c472 --- /dev/null +++ b/queue-4.4/qlcnic-fix-error-return-code-in-qlcnic_83xx_restart_hw.patch @@ -0,0 +1,34 @@ +From foo@baz Sun Nov 22 12:23:07 PM CET 2020 +From: Zhang Changzhong +Date: Fri, 13 Nov 2020 14:16:26 +0800 +Subject: qlcnic: fix error return code in qlcnic_83xx_restart_hw() + +From: Zhang Changzhong + +[ Upstream commit 3beb9be165083c2964eba1923601c3bfac0b02d4 ] + +Fix to return a negative error code from the error handling +case instead of 0, as done elsewhere in this function. + +Fixes: 3ced0a88cd4c ("qlcnic: Add support to run firmware POST") +Reported-by: Hulk Robot +Signed-off-by: Zhang Changzhong +Link: https://lore.kernel.org/r/1605248186-16013-1-git-send-email-zhangchangzhong@huawei.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c ++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c +@@ -2255,7 +2255,8 @@ static int qlcnic_83xx_restart_hw(struct + + /* Boot either flash image or firmware image from host file system */ + if (qlcnic_load_fw_file == 1) { +- if (qlcnic_83xx_load_fw_image_from_host(adapter)) ++ err = qlcnic_83xx_load_fw_image_from_host(adapter); ++ if (err) + return err; + } else { + QLC_SHARED_REG_WR32(adapter, QLCNIC_FW_IMG_VALID, diff --git a/queue-4.4/sctp-change-to-hold-put-transport-for-proto_unreach_timer.patch b/queue-4.4/sctp-change-to-hold-put-transport-for-proto_unreach_timer.patch new file mode 100644 index 00000000000..68de299bf9c --- /dev/null +++ b/queue-4.4/sctp-change-to-hold-put-transport-for-proto_unreach_timer.patch @@ -0,0 +1,102 @@ +From foo@baz Sun Nov 22 12:23:07 PM CET 2020 +From: Xin Long +Date: Sat, 14 Nov 2020 13:22:53 +0800 +Subject: sctp: change to hold/put transport for proto_unreach_timer + +From: Xin Long + +[ Upstream commit 057a10fa1f73d745c8e69aa54ab147715f5630ae ] + +A call trace was found in Hangbin's Codenomicon testing with debug kernel: + + [ 2615.981988] ODEBUG: free active (active state 0) object type: timer_list hint: sctp_generate_proto_unreach_event+0x0/0x3a0 [sctp] + [ 2615.995050] WARNING: CPU: 17 PID: 0 at lib/debugobjects.c:328 debug_print_object+0x199/0x2b0 + [ 2616.095934] RIP: 0010:debug_print_object+0x199/0x2b0 + [ 2616.191533] Call Trace: + [ 2616.194265] + [ 2616.202068] debug_check_no_obj_freed+0x25e/0x3f0 + [ 2616.207336] slab_free_freelist_hook+0xeb/0x140 + [ 2616.220971] kfree+0xd6/0x2c0 + [ 2616.224293] rcu_do_batch+0x3bd/0xc70 + [ 2616.243096] rcu_core+0x8b9/0xd00 + [ 2616.256065] __do_softirq+0x23d/0xacd + [ 2616.260166] irq_exit+0x236/0x2a0 + [ 2616.263879] smp_apic_timer_interrupt+0x18d/0x620 + [ 2616.269138] apic_timer_interrupt+0xf/0x20 + [ 2616.273711] + +This is because it holds asoc when transport->proto_unreach_timer starts +and puts asoc when the timer stops, and without holding transport the +transport could be freed when the timer is still running. + +So fix it by holding/putting transport instead for proto_unreach_timer +in transport, just like other timers in transport. + +v1->v2: + - Also use sctp_transport_put() for the "out_unlock:" path in + sctp_generate_proto_unreach_event(), as Marcelo noticed. + +Fixes: 50b5d6ad6382 ("sctp: Fix a race between ICMP protocol unreachable and connect()") +Reported-by: Hangbin Liu +Signed-off-by: Xin Long +Acked-by: Marcelo Ricardo Leitner +Link: https://lore.kernel.org/r/102788809b554958b13b95d33440f5448113b8d6.1605331373.git.lucien.xin@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/sctp/input.c | 4 ++-- + net/sctp/sm_sideeffect.c | 4 ++-- + net/sctp/transport.c | 2 +- + 3 files changed, 5 insertions(+), 5 deletions(-) + +--- a/net/sctp/input.c ++++ b/net/sctp/input.c +@@ -448,7 +448,7 @@ void sctp_icmp_proto_unreachable(struct + else { + if (!mod_timer(&t->proto_unreach_timer, + jiffies + (HZ/20))) +- sctp_association_hold(asoc); ++ sctp_transport_hold(t); + } + } else { + struct net *net = sock_net(sk); +@@ -457,7 +457,7 @@ void sctp_icmp_proto_unreachable(struct + "encountered!\n", __func__); + + if (del_timer(&t->proto_unreach_timer)) +- sctp_association_put(asoc); ++ sctp_transport_put(t); + + sctp_do_sm(net, SCTP_EVENT_T_OTHER, + SCTP_ST_OTHER(SCTP_EVENT_ICMP_PROTO_UNREACH), +--- a/net/sctp/sm_sideeffect.c ++++ b/net/sctp/sm_sideeffect.c +@@ -416,7 +416,7 @@ void sctp_generate_proto_unreach_event(u + /* Try again later. */ + if (!mod_timer(&transport->proto_unreach_timer, + jiffies + (HZ/20))) +- sctp_association_hold(asoc); ++ sctp_transport_hold(transport); + goto out_unlock; + } + +@@ -432,7 +432,7 @@ void sctp_generate_proto_unreach_event(u + + out_unlock: + bh_unlock_sock(sk); +- sctp_association_put(asoc); ++ sctp_transport_put(transport); + } + + +--- a/net/sctp/transport.c ++++ b/net/sctp/transport.c +@@ -148,7 +148,7 @@ void sctp_transport_free(struct sctp_tra + + /* Delete the ICMP proto unreachable timer if it's active. */ + if (del_timer(&transport->proto_unreach_timer)) +- sctp_association_put(transport->asoc); ++ sctp_transport_put(transport); + + sctp_transport_put(transport); + } diff --git a/queue-4.4/series b/queue-4.4/series new file mode 100644 index 00000000000..5e512825406 --- /dev/null +++ b/queue-4.4/series @@ -0,0 +1,12 @@ +ah6-fix-error-return-code-in-ah6_input.patch +atm-nicstar-unmap-dma-on-send-error.patch +net-b44-fix-error-return-code-in-b44_init_one.patch +net-bridge-add-missing-counters-to-ndo_get_stats64-callback.patch +netlabel-fix-our-progress-tracking-in-netlbl_unlabel_staticlist.patch +netlabel-fix-an-uninitialized-warning-in-netlbl_unlabel_staticlist.patch +net-mlx4_core-fix-init_hca-fields-offset.patch +net-x25-increase-refcnt-of-struct-x25_neigh-in-x25_rx_call_request.patch +qlcnic-fix-error-return-code-in-qlcnic_83xx_restart_hw.patch +sctp-change-to-hold-put-transport-for-proto_unreach_timer.patch +net-usb-qmi_wwan-set-dtr-quirk-for-mr400.patch +net-have-netpoll-bring-up-dsa-management-interface.patch