From: Greg Kroah-Hartman Date: Sun, 22 Nov 2020 10:57:58 +0000 (+0100) Subject: 5.4-stable patches X-Git-Tag: v4.4.246~50 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=b9cb6733151d8a0b752f56860e59361362e8f354;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: ah6-fix-error-return-code-in-ah6_input.patch atm-nicstar-unmap-dma-on-send-error.patch bnxt_en-read-eeprom-a2h-address-using-page-0.patch devlink-add-missing-genlmsg_cancel-in-devlink_nl_sb_port_pool_fill.patch exempt-multicast-addresses-from-five-second-neighbor-lifetime.patch inet_diag-fix-error-path-to-cancel-the-meseage-in-inet_req_diag_fill.patch ipv6-fix-error-path-to-cancel-the-meseage.patch lan743x-fix-issue-causing-intermittent-kernel-log-warnings.patch lan743x-prevent-entire-kernel-hang-on-open-for-some-platforms.patch mlxsw-core-use-variable-timeout-for-emad-retries.patch net-b44-fix-error-return-code-in-b44_init_one.patch net-bridge-add-missing-counters-to-ndo_get_stats64-callback.patch net-dsa-mv88e6xxx-avoid-vtu-corruption-on-6097.patch net-ethernet-ti-cpsw-fix-error-return-code-in-cpsw_probe.patch net-ftgmac100-fix-crash-when-removing-driver.patch net-have-netpoll-bring-up-dsa-management-interface.patch net-lantiq-wait-for-the-gphy-firmware-to-be-ready.patch net-mlx4_core-fix-init_hca-fields-offset.patch net-mlx5-add-handling-of-port-type-in-rule-deletion.patch net-mlx5-disable-qos-when-min_rates-on-all-vfs-are-zero.patch net-ncsi-fix-netlink-registration.patch net-qualcomm-rmnet-fix-incorrect-receive-packet-handling-during-cleanup.patch net-smc-fix-direct-access-to-ib_gid_addr-ndev-in-smc_ib_determine_gid.patch net-tls-fix-corrupted-data-in-recvmsg.patch net-usb-qmi_wwan-set-dtr-quirk-for-mr400.patch net-x25-increase-refcnt-of-struct-x25_neigh-in-x25_rx_call_request.patch netlabel-fix-an-uninitialized-warning-in-netlbl_unlabel_staticlist.patch netlabel-fix-our-progress-tracking-in-netlbl_unlabel_staticlist.patch page_frag-recover-from-memory-pressure.patch qed-fix-error-return-code-in-qed_iwarp_ll2_start.patch qlcnic-fix-error-return-code-in-qlcnic_83xx_restart_hw.patch sctp-change-to-hold-put-transport-for-proto_unreach_timer.patch tcp-only-postpone-probe_rtt-if-rtt-is-current-min_rtt-estimate.patch --- diff --git a/queue-5.4/ah6-fix-error-return-code-in-ah6_input.patch b/queue-5.4/ah6-fix-error-return-code-in-ah6_input.patch new file mode 100644 index 00000000000..2f9fb87c951 --- /dev/null +++ b/queue-5.4/ah6-fix-error-return-code-in-ah6_input.patch @@ -0,0 +1,34 @@ +From foo@baz Sun Nov 22 11:49:14 AM CET 2020 +From: Zhang Changzhong +Date: Tue, 17 Nov 2020 10:45:05 +0800 +Subject: ah6: fix error return code in ah6_input() + +From: Zhang Changzhong + +[ Upstream commit a5ebcbdf34b65fcc07f38eaf2d60563b42619a59 ] + +Fix to return a negative error code from the error handling +case instead of 0, as done elsewhere in this function. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Reported-by: Hulk Robot +Signed-off-by: Zhang Changzhong +Link: https://lore.kernel.org/r/1605581105-35295-1-git-send-email-zhangchangzhong@huawei.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/ah6.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/net/ipv6/ah6.c ++++ b/net/ipv6/ah6.c +@@ -588,7 +588,8 @@ static int ah6_input(struct xfrm_state * + memcpy(auth_data, ah->auth_data, ahp->icv_trunc_len); + memset(ah->auth_data, 0, ahp->icv_trunc_len); + +- if (ipv6_clear_mutable_options(ip6h, hdr_len, XFRM_POLICY_IN)) ++ err = ipv6_clear_mutable_options(ip6h, hdr_len, XFRM_POLICY_IN); ++ if (err) + goto out_free; + + ip6h->priority = 0; diff --git a/queue-5.4/atm-nicstar-unmap-dma-on-send-error.patch b/queue-5.4/atm-nicstar-unmap-dma-on-send-error.patch new file mode 100644 index 00000000000..6b341d7c4e1 --- /dev/null +++ b/queue-5.4/atm-nicstar-unmap-dma-on-send-error.patch @@ -0,0 +1,35 @@ +From foo@baz Sun Nov 22 11:49:14 AM CET 2020 +From: Sebastian Andrzej Siewior +Date: Mon, 16 Nov 2020 17:21:14 +0100 +Subject: atm: nicstar: Unmap DMA on send error + +From: Sebastian Andrzej Siewior + +[ Upstream commit 6dceaa9f56e22d0f9b4c4ad2ed9e04e315ce7fe5 ] + +The `skb' is mapped for DMA in ns_send() but does not unmap DMA in case +push_scqe() fails to submit the `skb'. The memory of the `skb' is +released so only the DMA mapping is leaking. + +Unmap the DMA mapping in case push_scqe() failed. + +Fixes: 864a3ff635fa7 ("atm: [nicstar] remove virt_to_bus() and support 64-bit platforms") +Cc: Chas Williams <3chas3@gmail.com> +Signed-off-by: Sebastian Andrzej Siewior +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/atm/nicstar.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/atm/nicstar.c ++++ b/drivers/atm/nicstar.c +@@ -1706,6 +1706,8 @@ static int ns_send(struct atm_vcc *vcc, + + if (push_scqe(card, vc, scq, &scqe, skb) != 0) { + atomic_inc(&vcc->stats->tx_err); ++ dma_unmap_single(&card->pcidev->dev, NS_PRV_DMA(skb), skb->len, ++ DMA_TO_DEVICE); + dev_kfree_skb_any(skb); + return -EIO; + } diff --git a/queue-5.4/bnxt_en-read-eeprom-a2h-address-using-page-0.patch b/queue-5.4/bnxt_en-read-eeprom-a2h-address-using-page-0.patch new file mode 100644 index 00000000000..6f352bfc6ea --- /dev/null +++ b/queue-5.4/bnxt_en-read-eeprom-a2h-address-using-page-0.patch @@ -0,0 +1,36 @@ +From foo@baz Sun Nov 22 11:49:14 AM CET 2020 +From: Edwin Peer +Date: Sun, 15 Nov 2020 19:27:49 -0500 +Subject: bnxt_en: read EEPROM A2h address using page 0 + +From: Edwin Peer + +[ Upstream commit 4260330b32b14330cfe427d568ac5f5b29b5be3d ] + +The module eeprom address range returned by bnxt_get_module_eeprom() +should be 256 bytes of A0h address space, the lower half of the A2h +address space, and page 0 for the upper half of the A2h address space. + +Fix the firmware call by passing page_number 0 for the A2h slave address +space. + +Fixes: 42ee18fe4ca2 ("bnxt_en: Add Support for ETHTOOL_GMODULEINFO and ETHTOOL_GMODULEEEPRO") +Signed-off-by: Edwin Peer +Signed-off-by: Michael Chan +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +@@ -2584,7 +2584,7 @@ static int bnxt_get_module_eeprom(struct + /* Read A2 portion of the EEPROM */ + if (length) { + start -= ETH_MODULE_SFF_8436_LEN; +- rc = bnxt_read_sfp_module_eeprom_info(bp, I2C_DEV_ADDR_A2, 1, ++ rc = bnxt_read_sfp_module_eeprom_info(bp, I2C_DEV_ADDR_A2, 0, + start, length, data); + } + return rc; diff --git a/queue-5.4/devlink-add-missing-genlmsg_cancel-in-devlink_nl_sb_port_pool_fill.patch b/queue-5.4/devlink-add-missing-genlmsg_cancel-in-devlink_nl_sb_port_pool_fill.patch new file mode 100644 index 00000000000..aeb3a9597d6 --- /dev/null +++ b/queue-5.4/devlink-add-missing-genlmsg_cancel-in-devlink_nl_sb_port_pool_fill.patch @@ -0,0 +1,45 @@ +From foo@baz Sun Nov 22 11:49:14 AM CET 2020 +From: Wang Hai +Date: Fri, 13 Nov 2020 19:16:22 +0800 +Subject: devlink: Add missing genlmsg_cancel() in devlink_nl_sb_port_pool_fill() + +From: Wang Hai + +[ Upstream commit 849920c703392957f94023f77ec89ca6cf119d43 ] + +If sb_occ_port_pool_get() failed in devlink_nl_sb_port_pool_fill(), +msg should be canceled by genlmsg_cancel(). + +Fixes: df38dafd2559 ("devlink: implement shared buffer occupancy monitoring interface") +Reported-by: Hulk Robot +Signed-off-by: Wang Hai +Link: https://lore.kernel.org/r/20201113111622.11040-1-wanghai38@huawei.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/core/devlink.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/net/core/devlink.c ++++ b/net/core/devlink.c +@@ -1144,7 +1144,7 @@ static int devlink_nl_sb_port_pool_fill( + err = ops->sb_occ_port_pool_get(devlink_port, devlink_sb->index, + pool_index, &cur, &max); + if (err && err != -EOPNOTSUPP) +- return err; ++ goto sb_occ_get_failure; + if (!err) { + if (nla_put_u32(msg, DEVLINK_ATTR_SB_OCC_CUR, cur)) + goto nla_put_failure; +@@ -1157,8 +1157,10 @@ static int devlink_nl_sb_port_pool_fill( + return 0; + + nla_put_failure: ++ err = -EMSGSIZE; ++sb_occ_get_failure: + genlmsg_cancel(msg, hdr); +- return -EMSGSIZE; ++ return err; + } + + static int devlink_nl_cmd_sb_port_pool_get_doit(struct sk_buff *skb, diff --git a/queue-5.4/exempt-multicast-addresses-from-five-second-neighbor-lifetime.patch b/queue-5.4/exempt-multicast-addresses-from-five-second-neighbor-lifetime.patch new file mode 100644 index 00000000000..6616e68987e --- /dev/null +++ b/queue-5.4/exempt-multicast-addresses-from-five-second-neighbor-lifetime.patch @@ -0,0 +1,115 @@ +From foo@baz Sun Nov 22 11:49:14 AM CET 2020 +From: Jeff Dike +Date: Thu, 12 Nov 2020 20:58:15 -0500 +Subject: Exempt multicast addresses from five-second neighbor lifetime + +From: Jeff Dike + +[ Upstream commit 8cf8821e15cd553339a5b48ee555a0439c2b2742 ] + +Commit 58956317c8de ("neighbor: Improve garbage collection") +guarantees neighbour table entries a five-second lifetime. Processes +which make heavy use of multicast can fill the neighour table with +multicast addresses in five seconds. At that point, neighbour entries +can't be GC-ed because they aren't five seconds old yet, the kernel +log starts to fill up with "neighbor table overflow!" messages, and +sends start to fail. + +This patch allows multicast addresses to be thrown out before they've +lived out their five seconds. This makes room for non-multicast +addresses and makes messages to all addresses more reliable in these +circumstances. + +Fixes: 58956317c8de ("neighbor: Improve garbage collection") +Signed-off-by: Jeff Dike +Reviewed-by: David Ahern +Link: https://lore.kernel.org/r/20201113015815.31397-1-jdike@akamai.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + include/net/neighbour.h | 1 + + net/core/neighbour.c | 2 ++ + net/ipv4/arp.c | 6 ++++++ + net/ipv6/ndisc.c | 7 +++++++ + 4 files changed, 16 insertions(+) + +--- a/include/net/neighbour.h ++++ b/include/net/neighbour.h +@@ -204,6 +204,7 @@ struct neigh_table { + int (*pconstructor)(struct pneigh_entry *); + void (*pdestructor)(struct pneigh_entry *); + void (*proxy_redo)(struct sk_buff *skb); ++ int (*is_multicast)(const void *pkey); + bool (*allow_add)(const struct net_device *dev, + struct netlink_ext_ack *extack); + char *id; +--- a/net/core/neighbour.c ++++ b/net/core/neighbour.c +@@ -235,6 +235,8 @@ static int neigh_forced_gc(struct neigh_ + + write_lock(&n->lock); + if ((n->nud_state == NUD_FAILED) || ++ (tbl->is_multicast && ++ tbl->is_multicast(n->primary_key)) || + time_after(tref, n->updated)) + remove = true; + write_unlock(&n->lock); +--- a/net/ipv4/arp.c ++++ b/net/ipv4/arp.c +@@ -125,6 +125,7 @@ static int arp_constructor(struct neighb + static void arp_solicit(struct neighbour *neigh, struct sk_buff *skb); + static void arp_error_report(struct neighbour *neigh, struct sk_buff *skb); + static void parp_redo(struct sk_buff *skb); ++static int arp_is_multicast(const void *pkey); + + static const struct neigh_ops arp_generic_ops = { + .family = AF_INET, +@@ -156,6 +157,7 @@ struct neigh_table arp_tbl = { + .key_eq = arp_key_eq, + .constructor = arp_constructor, + .proxy_redo = parp_redo, ++ .is_multicast = arp_is_multicast, + .id = "arp_cache", + .parms = { + .tbl = &arp_tbl, +@@ -928,6 +930,10 @@ static void parp_redo(struct sk_buff *sk + arp_process(dev_net(skb->dev), NULL, skb); + } + ++static int arp_is_multicast(const void *pkey) ++{ ++ return ipv4_is_multicast(*((__be32 *)pkey)); ++} + + /* + * Receive an arp request from the device layer. +--- a/net/ipv6/ndisc.c ++++ b/net/ipv6/ndisc.c +@@ -81,6 +81,7 @@ static void ndisc_error_report(struct ne + static int pndisc_constructor(struct pneigh_entry *n); + static void pndisc_destructor(struct pneigh_entry *n); + static void pndisc_redo(struct sk_buff *skb); ++static int ndisc_is_multicast(const void *pkey); + + static const struct neigh_ops ndisc_generic_ops = { + .family = AF_INET6, +@@ -115,6 +116,7 @@ struct neigh_table nd_tbl = { + .pconstructor = pndisc_constructor, + .pdestructor = pndisc_destructor, + .proxy_redo = pndisc_redo, ++ .is_multicast = ndisc_is_multicast, + .allow_add = ndisc_allow_add, + .id = "ndisc_cache", + .parms = { +@@ -1705,6 +1707,11 @@ static void pndisc_redo(struct sk_buff * + kfree_skb(skb); + } + ++static int ndisc_is_multicast(const void *pkey) ++{ ++ return ipv6_addr_is_multicast((struct in6_addr *)pkey); ++} ++ + static bool ndisc_suppress_frag_ndisc(struct sk_buff *skb) + { + struct inet6_dev *idev = __in6_dev_get(skb->dev); diff --git a/queue-5.4/inet_diag-fix-error-path-to-cancel-the-meseage-in-inet_req_diag_fill.patch b/queue-5.4/inet_diag-fix-error-path-to-cancel-the-meseage-in-inet_req_diag_fill.patch new file mode 100644 index 00000000000..f4cf2623ed1 --- /dev/null +++ b/queue-5.4/inet_diag-fix-error-path-to-cancel-the-meseage-in-inet_req_diag_fill.patch @@ -0,0 +1,36 @@ +From foo@baz Sun Nov 22 11:49:14 AM CET 2020 +From: Wang Hai +Date: Mon, 16 Nov 2020 16:20:18 +0800 +Subject: inet_diag: Fix error path to cancel the meseage in inet_req_diag_fill() + +From: Wang Hai + +[ Upstream commit e33de7c5317e2827b2ba6fd120a505e9eb727b05 ] + +nlmsg_cancel() needs to be called in the error path of +inet_req_diag_fill to cancel the message. + +Fixes: d545caca827b ("net: inet: diag: expose the socket mark to privileged processes.") +Reported-by: Hulk Robot +Signed-off-by: Wang Hai +Link: https://lore.kernel.org/r/20201116082018.16496-1-wanghai38@huawei.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/inet_diag.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/net/ipv4/inet_diag.c ++++ b/net/ipv4/inet_diag.c +@@ -388,8 +388,10 @@ static int inet_req_diag_fill(struct soc + r->idiag_inode = 0; + + if (net_admin && nla_put_u32(skb, INET_DIAG_MARK, +- inet_rsk(reqsk)->ir_mark)) ++ inet_rsk(reqsk)->ir_mark)) { ++ nlmsg_cancel(skb, nlh); + return -EMSGSIZE; ++ } + + nlmsg_end(skb, nlh); + return 0; diff --git a/queue-5.4/ipv6-fix-error-path-to-cancel-the-meseage.patch b/queue-5.4/ipv6-fix-error-path-to-cancel-the-meseage.patch new file mode 100644 index 00000000000..5a9fe0d11f3 --- /dev/null +++ b/queue-5.4/ipv6-fix-error-path-to-cancel-the-meseage.patch @@ -0,0 +1,49 @@ +From foo@baz Sun Nov 22 11:49:14 AM CET 2020 +From: Zhang Qilong +Date: Thu, 12 Nov 2020 16:09:50 +0800 +Subject: ipv6: Fix error path to cancel the meseage + +From: Zhang Qilong + +[ Upstream commit ceb736e1d45c253f5e86b185ca9b497cdd43063f ] + +genlmsg_cancel() needs to be called in the error path of +inet6_fill_ifmcaddr and inet6_fill_ifacaddr to cancel +the message. + +Fixes: 6ecf4c37eb3e ("ipv6: enable IFA_TARGET_NETNSID for RTM_GETADDR") +Reported-by: Hulk Robot +Signed-off-by: Zhang Qilong +Link: https://lore.kernel.org/r/20201112080950.1476302-1-zhangqilong3@huawei.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/addrconf.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/net/ipv6/addrconf.c ++++ b/net/ipv6/addrconf.c +@@ -4984,8 +4984,10 @@ static int inet6_fill_ifmcaddr(struct sk + return -EMSGSIZE; + + if (args->netnsid >= 0 && +- nla_put_s32(skb, IFA_TARGET_NETNSID, args->netnsid)) ++ nla_put_s32(skb, IFA_TARGET_NETNSID, args->netnsid)) { ++ nlmsg_cancel(skb, nlh); + return -EMSGSIZE; ++ } + + put_ifaddrmsg(nlh, 128, IFA_F_PERMANENT, scope, ifindex); + if (nla_put_in6_addr(skb, IFA_MULTICAST, &ifmca->mca_addr) < 0 || +@@ -5016,8 +5018,10 @@ static int inet6_fill_ifacaddr(struct sk + return -EMSGSIZE; + + if (args->netnsid >= 0 && +- nla_put_s32(skb, IFA_TARGET_NETNSID, args->netnsid)) ++ nla_put_s32(skb, IFA_TARGET_NETNSID, args->netnsid)) { ++ nlmsg_cancel(skb, nlh); + return -EMSGSIZE; ++ } + + put_ifaddrmsg(nlh, 128, IFA_F_PERMANENT, scope, ifindex); + if (nla_put_in6_addr(skb, IFA_ANYCAST, &ifaca->aca_addr) < 0 || diff --git a/queue-5.4/lan743x-fix-issue-causing-intermittent-kernel-log-warnings.patch b/queue-5.4/lan743x-fix-issue-causing-intermittent-kernel-log-warnings.patch new file mode 100644 index 00000000000..dd96cb6837c --- /dev/null +++ b/queue-5.4/lan743x-fix-issue-causing-intermittent-kernel-log-warnings.patch @@ -0,0 +1,132 @@ +From foo@baz Sun Nov 22 11:49:14 AM CET 2020 +From: Sven Van Asbroeck +Date: Thu, 12 Nov 2020 13:59:49 -0500 +Subject: lan743x: fix issue causing intermittent kernel log warnings + +From: Sven Van Asbroeck + +[ Upstream commit e35df62e04cc6fc4b9d90d054732f138349ff9b1 ] + +When running this chip on arm imx6, we intermittently observe +the following kernel warning in the log, especially when the +system is under high load: + +[ 50.119484] ------------[ cut here ]------------ +[ 50.124377] WARNING: CPU: 0 PID: 303 at kernel/softirq.c:169 __local_bh_enable_ip+0x100/0x184 +[ 50.132925] IRQs not enabled as expected +[ 50.159250] CPU: 0 PID: 303 Comm: rngd Not tainted 5.7.8 #1 +[ 50.164837] Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree) +[ 50.171395] [] (unwind_backtrace) from [] (show_stack+0x10/0x14) +[ 50.179162] [] (show_stack) from [] (dump_stack+0xac/0xd8) +[ 50.186408] [] (dump_stack) from [] (__warn+0xd0/0x10c) +[ 50.193391] [] (__warn) from [] (warn_slowpath_fmt+0x98/0xc4) +[ 50.200892] [] (warn_slowpath_fmt) from [] (__local_bh_enable_ip+0x100/0x184) +[ 50.209860] [] (__local_bh_enable_ip) from [] (destroy_conntrack+0x48/0xd8 [nf_conntrack]) +[ 50.220038] [] (destroy_conntrack [nf_conntrack]) from [] (nf_conntrack_destroy+0x94/0x168) +[ 50.230160] [] (nf_conntrack_destroy) from [] (skb_release_head_state+0xa0/0xd0) +[ 50.239314] [] (skb_release_head_state) from [] (skb_release_all+0xc/0x24) +[ 50.247946] [] (skb_release_all) from [] (consume_skb+0x74/0x17c) +[ 50.255796] [] (consume_skb) from [] (lan743x_tx_release_desc+0x120/0x124) +[ 50.264428] [] (lan743x_tx_release_desc) from [] (lan743x_tx_napi_poll+0x5c/0x18c) +[ 50.273755] [] (lan743x_tx_napi_poll) from [] (net_rx_action+0x118/0x4a4) +[ 50.282306] [] (net_rx_action) from [] (__do_softirq+0x13c/0x53c) +[ 50.290157] [] (__do_softirq) from [] (irq_exit+0x150/0x17c) +[ 50.297575] [] (irq_exit) from [] (__handle_domain_irq+0x60/0xb0) +[ 50.305423] [] (__handle_domain_irq) from [] (gic_handle_irq+0x4c/0x90) +[ 50.313790] [] (gic_handle_irq) from [] (__irq_usr+0x54/0x80) +[ 50.321287] Exception stack(0xecd99fb0 to 0xecd99ff8) +[ 50.326355] 9fa0: 1cf1aa74 00000001 00000001 00000000 +[ 50.334547] 9fc0: 00000001 00000000 00000000 00000000 00000000 00000000 00004097 b6d17d14 +[ 50.342738] 9fe0: 00000001 b6d17c60 00000000 b6e71f94 800b0010 ffffffff +[ 50.349364] irq event stamp: 2525027 +[ 50.352955] hardirqs last enabled at (2525026): [] net_rx_action+0xb4/0x4a4 +[ 50.360892] hardirqs last disabled at (2525027): [] _raw_spin_lock_irqsave+0x1c/0x50 +[ 50.369517] softirqs last enabled at (2524660): [] __do_softirq+0x38c/0x53c +[ 50.377446] softirqs last disabled at (2524693): [] irq_exit+0x150/0x17c +[ 50.385027] ---[ end trace c0b571db4bc8087d ]--- + +The driver is calling dev_kfree_skb() from code inside a spinlock, +where h/w interrupts are disabled. This is forbidden, as documented +in include/linux/netdevice.h. The correct function to use +dev_kfree_skb_irq(), or dev_kfree_skb_any(). + +Fix by using the correct dev_kfree_skb_xxx() functions: + +in lan743x_tx_release_desc(): + called by lan743x_tx_release_completed_descriptors() + called by in lan743x_tx_napi_poll() + which holds a spinlock + called by lan743x_tx_release_all_descriptors() + called by lan743x_tx_close() + which can-sleep +conclusion: use dev_kfree_skb_any() + +in lan743x_tx_xmit_frame(): + which holds a spinlock +conclusion: use dev_kfree_skb_irq() + +in lan743x_tx_close(): + which can-sleep +conclusion: use dev_kfree_skb() + +in lan743x_rx_release_ring_element(): + called by lan743x_rx_close() + which can-sleep + called by lan743x_rx_open() + which can-sleep +conclusion: use dev_kfree_skb() + +Fixes: 23f0703c125b ("lan743x: Add main source files for new lan743x driver") +Signed-off-by: Sven Van Asbroeck +Link: https://lore.kernel.org/r/20201112185949.11315-1-TheSven73@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/microchip/lan743x_main.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/drivers/net/ethernet/microchip/lan743x_main.c ++++ b/drivers/net/ethernet/microchip/lan743x_main.c +@@ -1242,13 +1242,13 @@ clean_up_data_descriptor: + goto clear_active; + + if (!(buffer_info->flags & TX_BUFFER_INFO_FLAG_TIMESTAMP_REQUESTED)) { +- dev_kfree_skb(buffer_info->skb); ++ dev_kfree_skb_any(buffer_info->skb); + goto clear_skb; + } + + if (cleanup) { + lan743x_ptp_unrequest_tx_timestamp(tx->adapter); +- dev_kfree_skb(buffer_info->skb); ++ dev_kfree_skb_any(buffer_info->skb); + } else { + ignore_sync = (buffer_info->flags & + TX_BUFFER_INFO_FLAG_IGNORE_SYNC) != 0; +@@ -1558,7 +1558,7 @@ static netdev_tx_t lan743x_tx_xmit_frame + if (required_number_of_descriptors > + lan743x_tx_get_avail_desc(tx)) { + if (required_number_of_descriptors > (tx->ring_size - 1)) { +- dev_kfree_skb(skb); ++ dev_kfree_skb_irq(skb); + } else { + /* save to overflow buffer */ + tx->overflow_skb = skb; +@@ -1591,7 +1591,7 @@ static netdev_tx_t lan743x_tx_xmit_frame + start_frame_length, + do_timestamp, + skb->ip_summed == CHECKSUM_PARTIAL)) { +- dev_kfree_skb(skb); ++ dev_kfree_skb_irq(skb); + goto unlock; + } + +@@ -1610,7 +1610,7 @@ static netdev_tx_t lan743x_tx_xmit_frame + * frame assembler clean up was performed inside + * lan743x_tx_frame_add_fragment + */ +- dev_kfree_skb(skb); ++ dev_kfree_skb_irq(skb); + goto unlock; + } + } diff --git a/queue-5.4/lan743x-prevent-entire-kernel-hang-on-open-for-some-platforms.patch b/queue-5.4/lan743x-prevent-entire-kernel-hang-on-open-for-some-platforms.patch new file mode 100644 index 00000000000..b2e3b50139b --- /dev/null +++ b/queue-5.4/lan743x-prevent-entire-kernel-hang-on-open-for-some-platforms.patch @@ -0,0 +1,65 @@ +From foo@baz Sun Nov 22 11:49:14 AM CET 2020 +From: Sven Van Asbroeck +Date: Thu, 12 Nov 2020 15:47:41 -0500 +Subject: lan743x: prevent entire kernel HANG on open, for some platforms + +From: Sven Van Asbroeck + +[ Upstream commit 796a2665ca3e91ebaba7222f76fd9a035714e2d8 ] + +On arm imx6, when opening the chip's netdev, the whole Linux +kernel intermittently hangs/freezes. + +This is caused by a bug in the driver code which tests if pcie +interrupts are working correctly, using the software interrupt: + +1. open: enable the software interrupt +2. open: tell the chip to assert the software interrupt +3. open: wait for flag +4. ISR: acknowledge s/w interrupt, set flag +5. open: notice flag, disable the s/w interrupt, continue + +Unfortunately the ISR only acknowledges the s/w interrupt, but +does not disable it. This will re-trigger the ISR in a tight +loop. + +On some (lucky) platforms, open proceeds to disable the s/w +interrupt even while the ISR is 'spinning'. On arm imx6, +the spinning ISR does not allow open to proceed, resulting +in a hung Linux kernel. + +Fix minimally by disabling the s/w interrupt in the ISR, which +will prevent it from spinning. This won't break anything because +the s/w interrupt is used as a one-shot interrupt. + +Note that this is a minimal fix, overlooking many possible +cleanups, e.g.: +- lan743x_intr_software_isr() is completely redundant and reads + INT_STS twice for no apparent reason +- disabling the s/w interrupt in lan743x_intr_test_isr() is now + redundant, but harmless +- waiting on software_isr_flag can be converted from a sleeping + poll loop to wait_event_timeout() + +Fixes: 23f0703c125b ("lan743x: Add main source files for new lan743x driver") +Tested-by: Sven Van Asbroeck # arm imx6 lan7430 +Signed-off-by: Sven Van Asbroeck +Link: https://lore.kernel.org/r/20201112204741.12375-1-TheSven73@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/microchip/lan743x_main.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/microchip/lan743x_main.c ++++ b/drivers/net/ethernet/microchip/lan743x_main.c +@@ -145,7 +145,8 @@ static void lan743x_intr_software_isr(vo + + int_sts = lan743x_csr_read(adapter, INT_STS); + if (int_sts & INT_BIT_SW_GP_) { +- lan743x_csr_write(adapter, INT_STS, INT_BIT_SW_GP_); ++ /* disable the interrupt to prevent repeated re-triggering */ ++ lan743x_csr_write(adapter, INT_EN_CLR, INT_BIT_SW_GP_); + intr->software_isr_flag = 1; + } + } diff --git a/queue-5.4/mlxsw-core-use-variable-timeout-for-emad-retries.patch b/queue-5.4/mlxsw-core-use-variable-timeout-for-emad-retries.patch new file mode 100644 index 00000000000..65d8f77bae4 --- /dev/null +++ b/queue-5.4/mlxsw-core-use-variable-timeout-for-emad-retries.patch @@ -0,0 +1,43 @@ +From foo@baz Sun Nov 22 11:49:14 AM CET 2020 +From: Ido Schimmel +Date: Tue, 17 Nov 2020 19:33:52 +0200 +Subject: mlxsw: core: Use variable timeout for EMAD retries + +From: Ido Schimmel + +[ Upstream commit 1f492eab67bced119a0ac7db75ef2047e29a30c6 ] + +The driver sends Ethernet Management Datagram (EMAD) packets to the +device for configuration purposes and waits for up to 200ms for a reply. +A request is retried up to 5 times. + +When the system is under heavy load, replies are not always processed in +time and EMAD transactions fail. + +Make the process more robust to such delays by using exponential +backoff. First wait for up to 200ms, then retransmit and wait for up to +400ms and so on. + +Fixes: caf7297e7ab5 ("mlxsw: core: Introduce support for asynchronous EMAD register access") +Reported-by: Denis Yulevich +Tested-by: Denis Yulevich +Signed-off-by: Ido Schimmel +Reviewed-by: Jiri Pirko +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/mellanox/mlxsw/core.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/mellanox/mlxsw/core.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/core.c +@@ -444,7 +444,8 @@ static void mlxsw_emad_trans_timeout_sch + if (trans->core->fw_flash_in_progress) + timeout = msecs_to_jiffies(MLXSW_EMAD_TIMEOUT_DURING_FW_FLASH_MS); + +- queue_delayed_work(trans->core->emad_wq, &trans->timeout_dw, timeout); ++ queue_delayed_work(trans->core->emad_wq, &trans->timeout_dw, ++ timeout << trans->retries); + } + + static int mlxsw_emad_transmit(struct mlxsw_core *mlxsw_core, diff --git a/queue-5.4/net-b44-fix-error-return-code-in-b44_init_one.patch b/queue-5.4/net-b44-fix-error-return-code-in-b44_init_one.patch new file mode 100644 index 00000000000..8f24f82c2ea --- /dev/null +++ b/queue-5.4/net-b44-fix-error-return-code-in-b44_init_one.patch @@ -0,0 +1,35 @@ +From foo@baz Sun Nov 22 11:49:14 AM CET 2020 +From: Zhang Changzhong +Date: Tue, 17 Nov 2020 11:02:11 +0800 +Subject: net: b44: fix error return code in b44_init_one() + +From: Zhang Changzhong + +[ Upstream commit 7b027c249da54f492699c43e26cba486cfd48035 ] + +Fix to return a negative error code from the error handling +case instead of 0, as done elsewhere in this function. + +Fixes: 39a6f4bce6b4 ("b44: replace the ssb_dma API with the generic DMA API") +Reported-by: Hulk Robot +Signed-off-by: Zhang Changzhong +Reviewed-by: Michael Chan +Link: https://lore.kernel.org/r/1605582131-36735-1-git-send-email-zhangchangzhong@huawei.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/broadcom/b44.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/broadcom/b44.c ++++ b/drivers/net/ethernet/broadcom/b44.c +@@ -2391,7 +2391,8 @@ static int b44_init_one(struct ssb_devic + goto err_out_free_dev; + } + +- if (dma_set_mask_and_coherent(sdev->dma_dev, DMA_BIT_MASK(30))) { ++ err = dma_set_mask_and_coherent(sdev->dma_dev, DMA_BIT_MASK(30)); ++ if (err) { + dev_err(sdev->dev, + "Required 30BIT DMA mask unsupported by the system\n"); + goto err_out_powerdown; diff --git a/queue-5.4/net-bridge-add-missing-counters-to-ndo_get_stats64-callback.patch b/queue-5.4/net-bridge-add-missing-counters-to-ndo_get_stats64-callback.patch new file mode 100644 index 00000000000..bd30d0e2a84 --- /dev/null +++ b/queue-5.4/net-bridge-add-missing-counters-to-ndo_get_stats64-callback.patch @@ -0,0 +1,32 @@ +From foo@baz Sun Nov 22 11:49:14 AM CET 2020 +From: Heiner Kallweit +Date: Fri, 13 Nov 2020 10:27:27 +0100 +Subject: net: bridge: add missing counters to ndo_get_stats64 callback + +From: Heiner Kallweit + +[ Upstream commit 7a30ecc9237681bb125cbd30eee92bef7e86293d ] + +In br_forward.c and br_input.c fields dev->stats.tx_dropped and +dev->stats.multicast are populated, but they are ignored in +ndo_get_stats64. + +Fixes: 28172739f0a2 ("net: fix 64 bit counters on 32 bit arches") +Signed-off-by: Heiner Kallweit +Link: https://lore.kernel.org/r/58ea9963-77ad-a7cf-8dfd-fc95ab95f606@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/bridge/br_device.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/net/bridge/br_device.c ++++ b/net/bridge/br_device.c +@@ -214,6 +214,7 @@ static void br_get_stats64(struct net_de + sum.rx_packets += tmp.rx_packets; + } + ++ netdev_stats_to_stats64(stats, &dev->stats); + stats->tx_bytes = sum.tx_bytes; + stats->tx_packets = sum.tx_packets; + stats->rx_bytes = sum.rx_bytes; diff --git a/queue-5.4/net-dsa-mv88e6xxx-avoid-vtu-corruption-on-6097.patch b/queue-5.4/net-dsa-mv88e6xxx-avoid-vtu-corruption-on-6097.patch new file mode 100644 index 00000000000..2ce6d215063 --- /dev/null +++ b/queue-5.4/net-dsa-mv88e6xxx-avoid-vtu-corruption-on-6097.patch @@ -0,0 +1,140 @@ +From foo@baz Sun Nov 22 11:49:14 AM CET 2020 +From: Tobias Waldekranz +Date: Thu, 12 Nov 2020 12:43:35 +0100 +Subject: net: dsa: mv88e6xxx: Avoid VTU corruption on 6097 + +From: Tobias Waldekranz + +[ Upstream commit 92307069a96c07d9b6e74b96b79390e7cd7d2111 ] + +As soon as you add the second port to a VLAN, all other port +membership configuration is overwritten with zeroes. The HW interprets +this as all ports being "unmodified members" of the VLAN. + +In the simple case when all ports belong to the same VLAN, switching +will still work. But using multiple VLANs or trying to set multiple +ports as tagged members will not work. + +On the 6352, doing a VTU GetNext op, followed by an STU GetNext op +will leave you with both the member- and state- data in the VTU/STU +data registers. But on the 6097 (which uses the same implementation), +the STU GetNext will override the information gathered from the VTU +GetNext. + +Separate the two stages, parsing the result of the VTU GetNext before +doing the STU GetNext. + +We opt to update the existing implementation for all applicable chips, +as opposed to creating a separate callback for 6097, because although +the previous implementation did work for (at least) 6352, the +datasheet does not mention the masking behavior. + +Fixes: ef6fcea37f01 ("net: dsa: mv88e6xxx: get STU entry on VTU GetNext") +Signed-off-by: Tobias Waldekranz +Link: https://lore.kernel.org/r/20201112114335.27371-1-tobias@waldekranz.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/dsa/mv88e6xxx/global1_vtu.c | 59 ++++++++++++++++++++++++++------ + 1 file changed, 49 insertions(+), 10 deletions(-) + +--- a/drivers/net/dsa/mv88e6xxx/global1_vtu.c ++++ b/drivers/net/dsa/mv88e6xxx/global1_vtu.c +@@ -125,11 +125,9 @@ static int mv88e6xxx_g1_vtu_vid_write(st + * Offset 0x08: VTU/STU Data Register 2 + * Offset 0x09: VTU/STU Data Register 3 + */ +- +-static int mv88e6185_g1_vtu_data_read(struct mv88e6xxx_chip *chip, +- struct mv88e6xxx_vtu_entry *entry) ++static int mv88e6185_g1_vtu_stu_data_read(struct mv88e6xxx_chip *chip, ++ u16 *regs) + { +- u16 regs[3]; + int i; + + /* Read all 3 VTU/STU Data registers */ +@@ -142,12 +140,45 @@ static int mv88e6185_g1_vtu_data_read(st + return err; + } + +- /* Extract MemberTag and PortState data */ ++ return 0; ++} ++ ++static int mv88e6185_g1_vtu_data_read(struct mv88e6xxx_chip *chip, ++ struct mv88e6xxx_vtu_entry *entry) ++{ ++ u16 regs[3]; ++ int err; ++ int i; ++ ++ err = mv88e6185_g1_vtu_stu_data_read(chip, regs); ++ if (err) ++ return err; ++ ++ /* Extract MemberTag data */ + for (i = 0; i < mv88e6xxx_num_ports(chip); ++i) { + unsigned int member_offset = (i % 4) * 4; +- unsigned int state_offset = member_offset + 2; + + entry->member[i] = (regs[i / 4] >> member_offset) & 0x3; ++ } ++ ++ return 0; ++} ++ ++static int mv88e6185_g1_stu_data_read(struct mv88e6xxx_chip *chip, ++ struct mv88e6xxx_vtu_entry *entry) ++{ ++ u16 regs[3]; ++ int err; ++ int i; ++ ++ err = mv88e6185_g1_vtu_stu_data_read(chip, regs); ++ if (err) ++ return err; ++ ++ /* Extract PortState data */ ++ for (i = 0; i < mv88e6xxx_num_ports(chip); ++i) { ++ unsigned int state_offset = (i % 4) * 4 + 2; ++ + entry->state[i] = (regs[i / 4] >> state_offset) & 0x3; + } + +@@ -349,6 +380,10 @@ int mv88e6185_g1_vtu_getnext(struct mv88 + if (err) + return err; + ++ err = mv88e6185_g1_stu_data_read(chip, entry); ++ if (err) ++ return err; ++ + /* VTU DBNum[3:0] are located in VTU Operation 3:0 + * VTU DBNum[7:4] are located in VTU Operation 11:8 + */ +@@ -374,16 +409,20 @@ int mv88e6352_g1_vtu_getnext(struct mv88 + return err; + + if (entry->valid) { +- /* Fetch (and mask) VLAN PortState data from the STU */ +- err = mv88e6xxx_g1_vtu_stu_get(chip, entry); ++ err = mv88e6185_g1_vtu_data_read(chip, entry); + if (err) + return err; + +- err = mv88e6185_g1_vtu_data_read(chip, entry); ++ err = mv88e6xxx_g1_vtu_fid_read(chip, entry); + if (err) + return err; + +- err = mv88e6xxx_g1_vtu_fid_read(chip, entry); ++ /* Fetch VLAN PortState data from the STU */ ++ err = mv88e6xxx_g1_vtu_stu_get(chip, entry); ++ if (err) ++ return err; ++ ++ err = mv88e6185_g1_stu_data_read(chip, entry); + if (err) + return err; + } diff --git a/queue-5.4/net-ethernet-ti-cpsw-fix-error-return-code-in-cpsw_probe.patch b/queue-5.4/net-ethernet-ti-cpsw-fix-error-return-code-in-cpsw_probe.patch new file mode 100644 index 00000000000..c9d0b55892c --- /dev/null +++ b/queue-5.4/net-ethernet-ti-cpsw-fix-error-return-code-in-cpsw_probe.patch @@ -0,0 +1,32 @@ +From foo@baz Sun Nov 22 11:49:14 AM CET 2020 +From: Zhang Changzhong +Date: Fri, 13 Nov 2020 14:49:33 +0800 +Subject: net: ethernet: ti: cpsw: fix error return code in cpsw_probe() + +From: Zhang Changzhong + +[ Upstream commit 35f735c665114840dcd3142f41148d07870f51f7 ] + +Fix to return a negative error code from the error handling +case instead of 0, as done elsewhere in this function. + +Fixes: 83a8471ba255 ("net: ethernet: ti: cpsw: refactor probe to group common hw initialization") +Reported-by: Hulk Robot +Signed-off-by: Zhang Changzhong +Link: https://lore.kernel.org/r/1605250173-18438-1-git-send-email-zhangchangzhong@huawei.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/ti/cpsw.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/ethernet/ti/cpsw.c ++++ b/drivers/net/ethernet/ti/cpsw.c +@@ -2876,6 +2876,7 @@ static int cpsw_probe(struct platform_de + CPSW_MAX_QUEUES, CPSW_MAX_QUEUES); + if (!ndev) { + dev_err(dev, "error allocating net_device\n"); ++ ret = -ENOMEM; + goto clean_cpts; + } + diff --git a/queue-5.4/net-ftgmac100-fix-crash-when-removing-driver.patch b/queue-5.4/net-ftgmac100-fix-crash-when-removing-driver.patch new file mode 100644 index 00000000000..06329c01374 --- /dev/null +++ b/queue-5.4/net-ftgmac100-fix-crash-when-removing-driver.patch @@ -0,0 +1,68 @@ +From foo@baz Sun Nov 22 11:49:14 AM CET 2020 +From: Joel Stanley +Date: Tue, 17 Nov 2020 13:14:48 +1030 +Subject: net: ftgmac100: Fix crash when removing driver + +From: Joel Stanley + +[ Upstream commit 3d5179458d22dc0b4fdc724e4bed4231a655112a ] + +When removing the driver we would hit BUG_ON(!list_empty(&dev->ptype_specific)) +in net/core/dev.c due to still having the NC-SI packet handler +registered. + + # echo 1e660000.ethernet > /sys/bus/platform/drivers/ftgmac100/unbind + ------------[ cut here ]------------ + kernel BUG at net/core/dev.c:10254! + Internal error: Oops - BUG: 0 [#1] SMP ARM + CPU: 0 PID: 115 Comm: sh Not tainted 5.10.0-rc3-next-20201111-00007-g02e0365710c4 #46 + Hardware name: Generic DT based system + PC is at netdev_run_todo+0x314/0x394 + LR is at cpumask_next+0x20/0x24 + pc : [<806f5830>] lr : [<80863cb0>] psr: 80000153 + sp : 855bbd58 ip : 00000001 fp : 855bbdac + r10: 80c03d00 r9 : 80c06228 r8 : 81158c54 + r7 : 00000000 r6 : 80c05dec r5 : 80c05d18 r4 : 813b9280 + r3 : 813b9054 r2 : 8122c470 r1 : 00000002 r0 : 00000002 + Flags: Nzcv IRQs on FIQs off Mode SVC_32 ISA ARM Segment none + Control: 00c5387d Table: 85514008 DAC: 00000051 + Process sh (pid: 115, stack limit = 0x7cb5703d) + ... + Backtrace: + [<806f551c>] (netdev_run_todo) from [<80707eec>] (rtnl_unlock+0x18/0x1c) + r10:00000051 r9:854ed710 r8:81158c54 r7:80c76bb0 r6:81158c10 r5:8115b410 + r4:813b9000 + [<80707ed4>] (rtnl_unlock) from [<806f5db8>] (unregister_netdev+0x2c/0x30) + [<806f5d8c>] (unregister_netdev) from [<805a8180>] (ftgmac100_remove+0x20/0xa8) + r5:8115b410 r4:813b9000 + [<805a8160>] (ftgmac100_remove) from [<805355e4>] (platform_drv_remove+0x34/0x4c) + +Fixes: bd466c3fb5a4 ("net/faraday: Support NCSI mode") +Signed-off-by: Joel Stanley +Link: https://lore.kernel.org/r/20201117024448.1170761-1-joel@jms.id.au +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/faraday/ftgmac100.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/net/ethernet/faraday/ftgmac100.c ++++ b/drivers/net/ethernet/faraday/ftgmac100.c +@@ -1891,6 +1891,8 @@ static int ftgmac100_probe(struct platfo + return 0; + + err_ncsi_dev: ++ if (priv->ndev) ++ ncsi_unregister_dev(priv->ndev); + err_register_netdev: + ftgmac100_destroy_mdio(netdev); + err_setup_mdio: +@@ -1911,6 +1913,8 @@ static int ftgmac100_remove(struct platf + netdev = platform_get_drvdata(pdev); + priv = netdev_priv(netdev); + ++ if (priv->ndev) ++ ncsi_unregister_dev(priv->ndev); + unregister_netdev(netdev); + + clk_disable_unprepare(priv->clk); diff --git a/queue-5.4/net-have-netpoll-bring-up-dsa-management-interface.patch b/queue-5.4/net-have-netpoll-bring-up-dsa-management-interface.patch new file mode 100644 index 00000000000..e7d3c2a4fd5 --- /dev/null +++ b/queue-5.4/net-have-netpoll-bring-up-dsa-management-interface.patch @@ -0,0 +1,81 @@ +From foo@baz Sun Nov 22 11:49:14 AM CET 2020 +From: Florian Fainelli +Date: Mon, 16 Nov 2020 19:52:34 -0800 +Subject: net: Have netpoll bring-up DSA management interface + +From: Florian Fainelli + +[ Upstream commit 1532b9778478577152201adbafa7738b1e844868 ] + +DSA network devices rely on having their DSA management interface up and +running otherwise their ndo_open() will return -ENETDOWN. Without doing +this it would not be possible to use DSA devices as netconsole when +configured on the command line. These devices also do not utilize the +upper/lower linking so the check about the netpoll device having upper +is not going to be a problem. + +The solution adopted here is identical to the one done for +net/ipv4/ipconfig.c with 728c02089a0e ("net: ipv4: handle DSA enabled +master network devices"), with the network namespace scope being +restricted to that of the process configuring netpoll. + +Fixes: 04ff53f96a93 ("net: dsa: Add netconsole support") +Tested-by: Vladimir Oltean +Signed-off-by: Florian Fainelli +Link: https://lore.kernel.org/r/20201117035236.22658-1-f.fainelli@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/core/netpoll.c | 22 ++++++++++++++++++---- + 1 file changed, 18 insertions(+), 4 deletions(-) + +--- a/net/core/netpoll.c ++++ b/net/core/netpoll.c +@@ -29,6 +29,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -637,15 +638,15 @@ EXPORT_SYMBOL_GPL(__netpoll_setup); + + int netpoll_setup(struct netpoll *np) + { +- struct net_device *ndev = NULL; ++ struct net_device *ndev = NULL, *dev = NULL; ++ struct net *net = current->nsproxy->net_ns; + struct in_device *in_dev; + int err; + + rtnl_lock(); +- if (np->dev_name[0]) { +- struct net *net = current->nsproxy->net_ns; ++ if (np->dev_name[0]) + ndev = __dev_get_by_name(net, np->dev_name); +- } ++ + if (!ndev) { + np_err(np, "%s doesn't exist, aborting\n", np->dev_name); + err = -ENODEV; +@@ -653,6 +654,19 @@ int netpoll_setup(struct netpoll *np) + } + dev_hold(ndev); + ++ /* bring up DSA management network devices up first */ ++ for_each_netdev(net, dev) { ++ if (!netdev_uses_dsa(dev)) ++ continue; ++ ++ err = dev_change_flags(dev, dev->flags | IFF_UP, NULL); ++ if (err < 0) { ++ np_err(np, "%s failed to open %s\n", ++ np->dev_name, dev->name); ++ goto put; ++ } ++ } ++ + if (netdev_master_upper_dev_get(ndev)) { + np_err(np, "%s is a slave device, aborting\n", np->dev_name); + err = -EBUSY; diff --git a/queue-5.4/net-lantiq-wait-for-the-gphy-firmware-to-be-ready.patch b/queue-5.4/net-lantiq-wait-for-the-gphy-firmware-to-be-ready.patch new file mode 100644 index 00000000000..c4eabf4d44b --- /dev/null +++ b/queue-5.4/net-lantiq-wait-for-the-gphy-firmware-to-be-ready.patch @@ -0,0 +1,73 @@ +From foo@baz Sun Nov 22 11:49:14 AM CET 2020 +From: Martin Blumenstingl +Date: Sun, 15 Nov 2020 17:57:57 +0100 +Subject: net: lantiq: Wait for the GPHY firmware to be ready + +From: Martin Blumenstingl + +[ Upstream commit 2a1828e378c1b5ba1ff283ed8f8c5cc37bb391dc ] + +A user reports (slightly shortened from the original message): + libphy: lantiq,xrx200-mdio: probed + mdio_bus 1e108000.switch-mii: MDIO device at address 17 is missing. + gswip 1e108000.switch lan: no phy at 2 + gswip 1e108000.switch lan: failed to connect to port 2: -19 + lantiq,xrx200-net 1e10b308.eth eth0: error -19 setting up slave phy + +This is a single-port board using the internal Fast Ethernet PHY. The +user reports that switching to PHY scanning instead of configuring the +PHY within device-tree works around this issue. + +The documentation for the standalone variant of the PHY11G (which is +probably very similar to what is used inside the xRX200 SoCs but having +the firmware burnt onto that standalone chip in the factory) states that +the PHY needs 300ms to be ready for MDIO communication after releasing +the reset. + +Add a 300ms delay after initializing all GPHYs to ensure that the GPHY +firmware had enough time to initialize and to appear on the MDIO bus. +Unfortunately there is no (known) documentation on what the minimum time +to wait after releasing the reset on an internal PHY so play safe and +take the one for the external variant. Only wait after the last GPHY +firmware is loaded to not slow down the initialization too much ( +xRX200 has two GPHYs but newer SoCs have at least three GPHYs). + +Fixes: 14fceff4771e51 ("net: dsa: Add Lantiq / Intel DSA driver for vrx200") +Reviewed-by: Andrew Lunn +Signed-off-by: Martin Blumenstingl +Acked-by: Hauke Mehrtens +Reviewed-by: Florian Fainelli +Link: https://lore.kernel.org/r/20201115165757.552641-1-martin.blumenstingl@googlemail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/dsa/lantiq_gswip.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +--- a/drivers/net/dsa/lantiq_gswip.c ++++ b/drivers/net/dsa/lantiq_gswip.c +@@ -26,6 +26,7 @@ + */ + + #include ++#include + #include + #include + #include +@@ -1818,6 +1819,16 @@ static int gswip_gphy_fw_list(struct gsw + i++; + } + ++ /* The standalone PHY11G requires 300ms to be fully ++ * initialized and ready for any MDIO communication after being ++ * taken out of reset. For the SoC-internal GPHY variant there ++ * is no (known) documentation for the minimum time after a ++ * reset. Use the same value as for the standalone variant as ++ * some users have reported internal PHYs not being detected ++ * without any delay. ++ */ ++ msleep(300); ++ + return 0; + + remove_gphy: diff --git a/queue-5.4/net-mlx4_core-fix-init_hca-fields-offset.patch b/queue-5.4/net-mlx4_core-fix-init_hca-fields-offset.patch new file mode 100644 index 00000000000..eeb2c08db19 --- /dev/null +++ b/queue-5.4/net-mlx4_core-fix-init_hca-fields-offset.patch @@ -0,0 +1,69 @@ +From foo@baz Sun Nov 22 11:49:14 AM CET 2020 +From: Aya Levin +Date: Wed, 18 Nov 2020 10:19:22 +0200 +Subject: net/mlx4_core: Fix init_hca fields offset + +From: Aya Levin + +[ Upstream commit 6d9c8d15af0ef20a66a0b432cac0d08319920602 ] + +Slave function read the following capabilities from the wrong offset: +1. log_mc_entry_sz +2. fs_log_entry_sz +3. log_mc_hash_sz + +Fix that by adjusting these capabilities offset to match firmware +layout. + +Due to the wrong offset read, the following issues might occur: +1+2. Negative value reported at max_mcast_qp_attach. +3. Driver to init FW with multicast hash size of zero. + +Fixes: a40ded604365 ("net/mlx4_core: Add masking for a few queries on HCA caps") +Signed-off-by: Aya Levin +Reviewed-by: Moshe Shemesh +Reviewed-by: Eran Ben Elisha +Signed-off-by: Tariq Toukan +Link: https://lore.kernel.org/r/20201118081922.553-1-tariqt@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/mellanox/mlx4/fw.c | 6 +++--- + drivers/net/ethernet/mellanox/mlx4/fw.h | 4 ++-- + 2 files changed, 5 insertions(+), 5 deletions(-) + +--- a/drivers/net/ethernet/mellanox/mlx4/fw.c ++++ b/drivers/net/ethernet/mellanox/mlx4/fw.c +@@ -1864,8 +1864,8 @@ int mlx4_INIT_HCA(struct mlx4_dev *dev, + #define INIT_HCA_LOG_RD_OFFSET (INIT_HCA_QPC_OFFSET + 0x77) + #define INIT_HCA_MCAST_OFFSET 0x0c0 + #define INIT_HCA_MC_BASE_OFFSET (INIT_HCA_MCAST_OFFSET + 0x00) +-#define INIT_HCA_LOG_MC_ENTRY_SZ_OFFSET (INIT_HCA_MCAST_OFFSET + 0x12) +-#define INIT_HCA_LOG_MC_HASH_SZ_OFFSET (INIT_HCA_MCAST_OFFSET + 0x16) ++#define INIT_HCA_LOG_MC_ENTRY_SZ_OFFSET (INIT_HCA_MCAST_OFFSET + 0x13) ++#define INIT_HCA_LOG_MC_HASH_SZ_OFFSET (INIT_HCA_MCAST_OFFSET + 0x17) + #define INIT_HCA_UC_STEERING_OFFSET (INIT_HCA_MCAST_OFFSET + 0x18) + #define INIT_HCA_LOG_MC_TABLE_SZ_OFFSET (INIT_HCA_MCAST_OFFSET + 0x1b) + #define INIT_HCA_DEVICE_MANAGED_FLOW_STEERING_EN 0x6 +@@ -1873,7 +1873,7 @@ int mlx4_INIT_HCA(struct mlx4_dev *dev, + #define INIT_HCA_DRIVER_VERSION_SZ 0x40 + #define INIT_HCA_FS_PARAM_OFFSET 0x1d0 + #define INIT_HCA_FS_BASE_OFFSET (INIT_HCA_FS_PARAM_OFFSET + 0x00) +-#define INIT_HCA_FS_LOG_ENTRY_SZ_OFFSET (INIT_HCA_FS_PARAM_OFFSET + 0x12) ++#define INIT_HCA_FS_LOG_ENTRY_SZ_OFFSET (INIT_HCA_FS_PARAM_OFFSET + 0x13) + #define INIT_HCA_FS_A0_OFFSET (INIT_HCA_FS_PARAM_OFFSET + 0x18) + #define INIT_HCA_FS_LOG_TABLE_SZ_OFFSET (INIT_HCA_FS_PARAM_OFFSET + 0x1b) + #define INIT_HCA_FS_ETH_BITS_OFFSET (INIT_HCA_FS_PARAM_OFFSET + 0x21) +--- a/drivers/net/ethernet/mellanox/mlx4/fw.h ++++ b/drivers/net/ethernet/mellanox/mlx4/fw.h +@@ -182,8 +182,8 @@ struct mlx4_init_hca_param { + u64 cmpt_base; + u64 mtt_base; + u64 global_caps; +- u16 log_mc_entry_sz; +- u16 log_mc_hash_sz; ++ u8 log_mc_entry_sz; ++ u8 log_mc_hash_sz; + u16 hca_core_clock; /* Internal Clock Frequency (in MHz) */ + u8 log_num_qps; + u8 log_num_srqs; diff --git a/queue-5.4/net-mlx5-add-handling-of-port-type-in-rule-deletion.patch b/queue-5.4/net-mlx5-add-handling-of-port-type-in-rule-deletion.patch new file mode 100644 index 00000000000..be0028707f8 --- /dev/null +++ b/queue-5.4/net-mlx5-add-handling-of-port-type-in-rule-deletion.patch @@ -0,0 +1,112 @@ +From foo@baz Sun Nov 22 11:49:14 AM CET 2020 +From: Michael Guralnik +Date: Mon, 2 Nov 2020 17:34:44 +0200 +Subject: net/mlx5: Add handling of port type in rule deletion + +From: Michael Guralnik + +[ Upstream commit 8cbcc5ef2a281f6bb10099f4572a08cb765ffbf4 ] + +Handle destruction of rules with port destination type to enable +full destruction of flow. + +Without this handling of TX rules the deletion of these rules fails. +Dmesg of flow destruction failure: + +[ 203.714146] mlx5_core 0000:00:0b.0: mlx5_cmd_check:753:(pid 342): SET_FLOW_TABLE_ENTRY(0x936) op_mod(0x0) failed, status bad parameter(0x3), syndrome (0x144b7a) +[ 210.547387] ------------[ cut here ]------------ +[ 210.548663] refcount_t: decrement hit 0; leaking memory. +[ 210.550651] WARNING: CPU: 4 PID: 342 at lib/refcount.c:31 refcount_warn_saturate+0x5c/0x110 +[ 210.550654] Modules linked in: mlx5_ib mlx5_core ib_ipoib rdma_ucm rdma_cm iw_cm ib_cm ib_umad ib_uverbs ib_core +[ 210.550675] CPU: 4 PID: 342 Comm: test Not tainted 5.8.0-rc2+ #116 +[ 210.550678] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 +[ 210.550680] RIP: 0010:refcount_warn_saturate+0x5c/0x110 +[ 210.550685] Code: c6 d1 1b 01 00 0f 84 ad 00 00 00 5b 5d c3 80 3d b5 d1 1b 01 00 75 f4 48 c7 c7 20 d1 15 82 c6 05 a5 d1 1b 01 01 e8 a7 eb af ff <0f> 0b eb dd 80 3d 99 d1 1b 01 00 75 d4 48 c7 c7 c0 cf 15 82 c6 05 +[ 210.550687] RSP: 0018:ffff8881642e77e8 EFLAGS: 00010282 +[ 210.550691] RAX: 0000000000000000 RBX: 0000000000000004 RCX: 0000000000000000 +[ 210.550694] RDX: 0000000000000027 RSI: 0000000000000004 RDI: ffffed102c85ceef +[ 210.550696] RBP: ffff888161720428 R08: ffffffff8124c10e R09: ffffed103243beae +[ 210.550698] R10: ffff8881921df56b R11: ffffed103243bead R12: ffff8881841b4180 +[ 210.550701] R13: ffff888161720428 R14: ffff8881616d0000 R15: ffff888161720380 +[ 210.550704] FS: 00007fc27f025740(0000) GS:ffff888192000000(0000) knlGS:0000000000000000 +[ 210.550706] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 210.550708] CR2: 0000557e4b41a6a0 CR3: 0000000002415004 CR4: 0000000000360ea0 +[ 210.550711] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +[ 210.550713] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +[ 210.550715] Call Trace: +[ 210.550717] mlx5_del_flow_rules+0x484/0x490 [mlx5_core] +[ 210.550720] ? mlx5_cmd_set_fte+0xa80/0xa80 [mlx5_core] +[ 210.550722] mlx5_ib_destroy_flow+0x17f/0x280 [mlx5_ib] +[ 210.550724] uverbs_free_flow+0x4c/0x90 [ib_uverbs] +[ 210.550726] destroy_hw_idr_uobject+0x41/0xb0 [ib_uverbs] +[ 210.550728] uverbs_destroy_uobject+0xaa/0x390 [ib_uverbs] +[ 210.550731] __uverbs_cleanup_ufile+0x129/0x1b0 [ib_uverbs] +[ 210.550733] ? uverbs_destroy_uobject+0x390/0x390 [ib_uverbs] +[ 210.550735] uverbs_destroy_ufile_hw+0x78/0x190 [ib_uverbs] +[ 210.550737] ib_uverbs_close+0x36/0x140 [ib_uverbs] +[ 210.550739] __fput+0x181/0x380 +[ 210.550741] task_work_run+0x88/0xd0 +[ 210.550743] do_exit+0x5f6/0x13b0 +[ 210.550745] ? sched_clock_cpu+0x30/0x140 +[ 210.550747] ? is_current_pgrp_orphaned+0x70/0x70 +[ 210.550750] ? lock_downgrade+0x360/0x360 +[ 210.550752] ? mark_held_locks+0x1d/0x90 +[ 210.550754] do_group_exit+0x8a/0x140 +[ 210.550756] get_signal+0x20a/0xf50 +[ 210.550758] do_signal+0x8c/0xbe0 +[ 210.550760] ? hrtimer_nanosleep+0x1d8/0x200 +[ 210.550762] ? nanosleep_copyout+0x50/0x50 +[ 210.550764] ? restore_sigcontext+0x320/0x320 +[ 210.550766] ? __hrtimer_init+0xf0/0xf0 +[ 210.550768] ? timespec64_add_safe+0x150/0x150 +[ 210.550770] ? mark_held_locks+0x1d/0x90 +[ 210.550772] ? lockdep_hardirqs_on_prepare+0x14c/0x240 +[ 210.550774] __prepare_exit_to_usermode+0x119/0x170 +[ 210.550776] do_syscall_64+0x65/0x300 +[ 210.550778] ? trace_hardirqs_off+0x10/0x120 +[ 210.550781] ? mark_held_locks+0x1d/0x90 +[ 210.550783] ? asm_sysvec_apic_timer_interrupt+0xa/0x20 +[ 210.550785] ? lockdep_hardirqs_on+0x112/0x190 +[ 210.550787] entry_SYSCALL_64_after_hwframe+0x44/0xa9 +[ 210.550789] RIP: 0033:0x7fc27f1cd157 +[ 210.550791] Code: Bad RIP value. +[ 210.550793] RSP: 002b:00007ffd4db27ea8 EFLAGS: 00000246 ORIG_RAX: 0000000000000023 +[ 210.550798] RAX: fffffffffffffdfc RBX: ffffffffffffff80 RCX: 00007fc27f1cd157 +[ 210.550800] RDX: 00007fc27f025740 RSI: 00007ffd4db27eb0 RDI: 00007ffd4db27eb0 +[ 210.550803] RBP: 0000000000000016 R08: 0000000000000000 R09: 000000000000000e +[ 210.550805] R10: 00007ffd4db27dc7 R11: 0000000000000246 R12: 0000000000400c00 +[ 210.550808] R13: 00007ffd4db285f0 R14: 0000000000000000 R15: 0000000000000000 +[ 210.550809] irq event stamp: 49399 +[ 210.550812] hardirqs last enabled at (49399): [] console_unlock+0x556/0x6f0 +[ 210.550815] hardirqs last disabled at (49398): [] console_unlock+0xb7/0x6f0 +[ 210.550818] softirqs last enabled at (48706): [] __do_softirq+0x37b/0x60c +[ 210.550820] softirqs last disabled at (48697): [] asm_call_on_stack+0xf/0x20 +[ 210.550822] ---[ end trace ad18c0e6fa846454 ]--- +[ 210.581862] mlx5_core 0000:00:0c.0: mlx5_destroy_flow_table:2132:(pid 342): Flow table 262150 wasn't destroyed, refcount > 1 + +Fixes: a7ee18bdee83 ("RDMA/mlx5: Allow creating a matcher for a NIC TX flow table") +Signed-off-by: Michael Guralnik +Reviewed-by: Mark Bloch +Reviewed-by: Maor Gottlieb +Signed-off-by: Saeed Mahameed +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c +@@ -496,6 +496,13 @@ static void del_sw_hw_rule(struct fs_nod + goto out; + } + ++ if (rule->dest_attr.type == MLX5_FLOW_DESTINATION_TYPE_PORT && ++ --fte->dests_size) { ++ fte->modify_mask |= BIT(MLX5_SET_FTE_MODIFY_ENABLE_MASK_ACTION); ++ fte->action.action &= ~MLX5_FLOW_CONTEXT_ACTION_ALLOW; ++ goto out; ++ } ++ + if ((fte->action.action & MLX5_FLOW_CONTEXT_ACTION_FWD_DEST) && + --fte->dests_size) { + fte->modify_mask |= diff --git a/queue-5.4/net-mlx5-disable-qos-when-min_rates-on-all-vfs-are-zero.patch b/queue-5.4/net-mlx5-disable-qos-when-min_rates-on-all-vfs-are-zero.patch new file mode 100644 index 00000000000..7d346ed5b51 --- /dev/null +++ b/queue-5.4/net-mlx5-disable-qos-when-min_rates-on-all-vfs-are-zero.patch @@ -0,0 +1,77 @@ +From foo@baz Sun Nov 22 11:49:14 AM CET 2020 +From: Vladyslav Tarasiuk +Date: Wed, 21 Oct 2020 11:05:41 +0300 +Subject: net/mlx5: Disable QoS when min_rates on all VFs are zero + +From: Vladyslav Tarasiuk + +[ Upstream commit 470b74758260e4abc2508cf1614573c00a00465c ] + +Currently when QoS is enabled for VF and any min_rate is configured, +the driver sets bw_share value to at least 1 and doesn’t allow to set +it to 0 to make minimal rate unlimited. It means there is always a +minimal rate configured for every VF, even if user tries to remove it. + +In order to make QoS disable possible, check whether all vports have +configured min_rate = 0. If this is true, set their bw_share to 0 to +disable min_rate limitations. + +Fixes: c9497c98901c ("net/mlx5: Add support for setting VF min rate") +Signed-off-by: Vladyslav Tarasiuk +Reviewed-by: Moshe Shemesh +Signed-off-by: Saeed Mahameed +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/mellanox/mlx5/core/eswitch.c | 15 ++++++++------- + 1 file changed, 8 insertions(+), 7 deletions(-) + +--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c +@@ -2369,12 +2369,15 @@ static u32 calculate_vports_min_rate_div + max_guarantee = evport->info.min_rate; + } + +- return max_t(u32, max_guarantee / fw_max_bw_share, 1); ++ if (max_guarantee) ++ return max_t(u32, max_guarantee / fw_max_bw_share, 1); ++ return 0; + } + +-static int normalize_vports_min_rate(struct mlx5_eswitch *esw, u32 divider) ++static int normalize_vports_min_rate(struct mlx5_eswitch *esw) + { + u32 fw_max_bw_share = MLX5_CAP_QOS(esw->dev, max_tsar_bw_share); ++ u32 divider = calculate_vports_min_rate_divider(esw); + struct mlx5_vport *evport; + u32 vport_max_rate; + u32 vport_min_rate; +@@ -2387,9 +2390,9 @@ static int normalize_vports_min_rate(str + continue; + vport_min_rate = evport->info.min_rate; + vport_max_rate = evport->info.max_rate; +- bw_share = MLX5_MIN_BW_SHARE; ++ bw_share = 0; + +- if (vport_min_rate) ++ if (divider) + bw_share = MLX5_RATE_TO_BW_SHARE(vport_min_rate, + divider, + fw_max_bw_share); +@@ -2414,7 +2417,6 @@ int mlx5_eswitch_set_vport_rate(struct m + struct mlx5_vport *evport = mlx5_eswitch_get_vport(esw, vport); + u32 fw_max_bw_share; + u32 previous_min_rate; +- u32 divider; + bool min_rate_supported; + bool max_rate_supported; + int err = 0; +@@ -2439,8 +2441,7 @@ int mlx5_eswitch_set_vport_rate(struct m + + previous_min_rate = evport->info.min_rate; + evport->info.min_rate = min_rate; +- divider = calculate_vports_min_rate_divider(esw); +- err = normalize_vports_min_rate(esw, divider); ++ err = normalize_vports_min_rate(esw); + if (err) { + evport->info.min_rate = previous_min_rate; + goto unlock; diff --git a/queue-5.4/net-ncsi-fix-netlink-registration.patch b/queue-5.4/net-ncsi-fix-netlink-registration.patch new file mode 100644 index 00000000000..704868d72d0 --- /dev/null +++ b/queue-5.4/net-ncsi-fix-netlink-registration.patch @@ -0,0 +1,129 @@ +From foo@baz Sun Nov 22 11:49:14 AM CET 2020 +From: Joel Stanley +Date: Thu, 12 Nov 2020 16:42:10 +1030 +Subject: net/ncsi: Fix netlink registration + +From: Joel Stanley + +[ Upstream commit 1922a46b8c18cb09d33e06a6cc2e43844ac1b9d0 ] + +If a user unbinds and re-binds a NC-SI aware driver the kernel will +attempt to register the netlink interface at runtime. The structure is +marked __ro_after_init so registration fails spectacularly at this point. + + # echo 1e660000.ethernet > /sys/bus/platform/drivers/ftgmac100/unbind + # echo 1e660000.ethernet > /sys/bus/platform/drivers/ftgmac100/bind + ftgmac100 1e660000.ethernet: Read MAC address 52:54:00:12:34:56 from chip + ftgmac100 1e660000.ethernet: Using NCSI interface + 8<--- cut here --- + Unable to handle kernel paging request at virtual address 80a8f858 + pgd = 8c768dd6 + [80a8f858] *pgd=80a0841e(bad) + Internal error: Oops: 80d [#1] SMP ARM + CPU: 0 PID: 116 Comm: sh Not tainted 5.10.0-rc3-next-20201111-00003-gdd25b227ec1e #51 + Hardware name: Generic DT based system + PC is at genl_register_family+0x1f8/0x6d4 + LR is at 0xff26ffff + pc : [<8073f930>] lr : [] psr: 20000153 + sp : 8553bc80 ip : 81406244 fp : 8553bd04 + r10: 8085d12c r9 : 80a8f73c r8 : 85739000 + r7 : 00000017 r6 : 80a8f860 r5 : 80c8ab98 r4 : 80a8f858 + r3 : 00000000 r2 : 00000000 r1 : 81406130 r0 : 00000017 + Flags: nzCv IRQs on FIQs off Mode SVC_32 ISA ARM Segment none + Control: 00c5387d Table: 85524008 DAC: 00000051 + Process sh (pid: 116, stack limit = 0x1f1988d6) + ... + Backtrace: + [<8073f738>] (genl_register_family) from [<80860ac0>] (ncsi_init_netlink+0x20/0x48) + r10:8085d12c r9:80c8fb0c r8:85739000 r7:00000000 r6:81218000 r5:85739000 + r4:8121c000 + [<80860aa0>] (ncsi_init_netlink) from [<8085d740>] (ncsi_register_dev+0x1b0/0x210) + r5:8121c400 r4:8121c000 + [<8085d590>] (ncsi_register_dev) from [<805a8060>] (ftgmac100_probe+0x6e0/0x778) + r10:00000004 r9:80950228 r8:8115bc10 r7:8115ab00 r6:9eae2c24 r5:813b6f88 + r4:85739000 + [<805a7980>] (ftgmac100_probe) from [<805355ec>] (platform_drv_probe+0x58/0xa8) + r9:80c76bb0 r8:00000000 r7:80cd4974 r6:80c76bb0 r5:8115bc10 r4:00000000 + [<80535594>] (platform_drv_probe) from [<80532d58>] (really_probe+0x204/0x514) + r7:80cd4974 r6:00000000 r5:80cd4868 r4:8115bc10 + +Jakub pointed out that ncsi_register_dev is obviously broken, because +there is only one family so it would never work if there was more than +one ncsi netdev. + +Fix the crash by registering the netlink family once on boot, and drop +the code to unregister it. + +Fixes: 955dc68cb9b2 ("net/ncsi: Add generic netlink family") +Signed-off-by: Joel Stanley +Reviewed-by: Samuel Mendoza-Jonas +Link: https://lore.kernel.org/r/20201112061210.914621-1-joel@jms.id.au +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/ncsi/ncsi-manage.c | 5 ----- + net/ncsi/ncsi-netlink.c | 22 +++------------------- + net/ncsi/ncsi-netlink.h | 3 --- + 3 files changed, 3 insertions(+), 27 deletions(-) + +--- a/net/ncsi/ncsi-manage.c ++++ b/net/ncsi/ncsi-manage.c +@@ -1667,9 +1667,6 @@ struct ncsi_dev *ncsi_register_dev(struc + ndp->ptype.dev = dev; + dev_add_pack(&ndp->ptype); + +- /* Set up generic netlink interface */ +- ncsi_init_netlink(dev); +- + return nd; + } + EXPORT_SYMBOL_GPL(ncsi_register_dev); +@@ -1826,8 +1823,6 @@ void ncsi_unregister_dev(struct ncsi_dev + list_del_rcu(&ndp->node); + spin_unlock_irqrestore(&ncsi_dev_lock, flags); + +- ncsi_unregister_netlink(nd->dev); +- + kfree(ndp); + } + EXPORT_SYMBOL_GPL(ncsi_unregister_dev); +--- a/net/ncsi/ncsi-netlink.c ++++ b/net/ncsi/ncsi-netlink.c +@@ -766,24 +766,8 @@ static struct genl_family ncsi_genl_fami + .n_ops = ARRAY_SIZE(ncsi_ops), + }; + +-int ncsi_init_netlink(struct net_device *dev) ++static int __init ncsi_init_netlink(void) + { +- int rc; +- +- rc = genl_register_family(&ncsi_genl_family); +- if (rc) +- netdev_err(dev, "ncsi: failed to register netlink family\n"); +- +- return rc; +-} +- +-int ncsi_unregister_netlink(struct net_device *dev) +-{ +- int rc; +- +- rc = genl_unregister_family(&ncsi_genl_family); +- if (rc) +- netdev_err(dev, "ncsi: failed to unregister netlink family\n"); +- +- return rc; ++ return genl_register_family(&ncsi_genl_family); + } ++subsys_initcall(ncsi_init_netlink); +--- a/net/ncsi/ncsi-netlink.h ++++ b/net/ncsi/ncsi-netlink.h +@@ -22,7 +22,4 @@ int ncsi_send_netlink_err(struct net_dev + struct nlmsghdr *nlhdr, + int err); + +-int ncsi_init_netlink(struct net_device *dev); +-int ncsi_unregister_netlink(struct net_device *dev); +- + #endif /* __NCSI_NETLINK_H__ */ diff --git a/queue-5.4/net-qualcomm-rmnet-fix-incorrect-receive-packet-handling-during-cleanup.patch b/queue-5.4/net-qualcomm-rmnet-fix-incorrect-receive-packet-handling-during-cleanup.patch new file mode 100644 index 00000000000..5ce91d1f05b --- /dev/null +++ b/queue-5.4/net-qualcomm-rmnet-fix-incorrect-receive-packet-handling-during-cleanup.patch @@ -0,0 +1,54 @@ +From foo@baz Sun Nov 22 11:49:14 AM CET 2020 +From: Subash Abhinov Kasiviswanathan +Date: Fri, 13 Nov 2020 13:12:05 -0700 +Subject: net: qualcomm: rmnet: Fix incorrect receive packet handling during cleanup + +From: Subash Abhinov Kasiviswanathan + +[ Upstream commit fc70f5bf5e525dde81565f0a30d5e39168062eba ] + +During rmnet unregistration, the real device rx_handler is first cleared +followed by the removal of rx_handler_data after the rcu synchronization. + +Any packets in the receive path may observe that the rx_handler is NULL. +However, there is no check when dereferencing this value to use the +rmnet_port information. + +This fixes following splat by adding the NULL check. + +Unable to handle kernel NULL pointer dereference at virtual +address 000000000000000d +pc : rmnet_rx_handler+0x124/0x284 +lr : rmnet_rx_handler+0x124/0x284 + rmnet_rx_handler+0x124/0x284 + __netif_receive_skb_core+0x758/0xd74 + __netif_receive_skb+0x50/0x17c + process_backlog+0x15c/0x1b8 + napi_poll+0x88/0x284 + net_rx_action+0xbc/0x23c + __do_softirq+0x20c/0x48c + +Fixes: ceed73a2cf4a ("drivers: net: ethernet: qualcomm: rmnet: Initial implementation") +Signed-off-by: Sean Tranchetti +Signed-off-by: Subash Abhinov Kasiviswanathan +Link: https://lore.kernel.org/r/1605298325-3705-1-git-send-email-subashab@codeaurora.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c ++++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c +@@ -188,6 +188,11 @@ rx_handler_result_t rmnet_rx_handler(str + + dev = skb->dev; + port = rmnet_get_port_rcu(dev); ++ if (unlikely(!port)) { ++ atomic_long_inc(&skb->dev->rx_nohandler); ++ kfree_skb(skb); ++ goto done; ++ } + + switch (port->rmnet_mode) { + case RMNET_EPMODE_VND: diff --git a/queue-5.4/net-smc-fix-direct-access-to-ib_gid_addr-ndev-in-smc_ib_determine_gid.patch b/queue-5.4/net-smc-fix-direct-access-to-ib_gid_addr-ndev-in-smc_ib_determine_gid.patch new file mode 100644 index 00000000000..faf119b1c42 --- /dev/null +++ b/queue-5.4/net-smc-fix-direct-access-to-ib_gid_addr-ndev-in-smc_ib_determine_gid.patch @@ -0,0 +1,40 @@ +From foo@baz Sun Nov 22 11:49:14 AM CET 2020 +From: Karsten Graul +Date: Wed, 18 Nov 2020 22:40:38 +0100 +Subject: net/smc: fix direct access to ib_gid_addr->ndev in smc_ib_determine_gid() + +From: Karsten Graul + +[ Upstream commit 41a0be3f8f6be893860b991eb10c47fc3ee09d7f ] + +Sparse complaints 3 times about: +net/smc/smc_ib.c:203:52: warning: incorrect type in argument 1 (different address spaces) +net/smc/smc_ib.c:203:52: expected struct net_device const *dev +net/smc/smc_ib.c:203:52: got struct net_device [noderef] __rcu *const ndev + +Fix that by using the existing and validated ndev variable instead of +accessing attr->ndev directly. + +Fixes: 5102eca9039b ("net/smc: Use rdma_read_gid_l2_fields to L2 fields") +Signed-off-by: Karsten Graul +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/smc/smc_ib.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/net/smc/smc_ib.c ++++ b/net/smc/smc_ib.c +@@ -191,9 +191,9 @@ int smc_ib_determine_gid(struct smc_ib_d + rcu_read_lock(); + ndev = rdma_read_gid_attr_ndev_rcu(attr); + if (!IS_ERR(ndev) && +- ((!vlan_id && !is_vlan_dev(attr->ndev)) || +- (vlan_id && is_vlan_dev(attr->ndev) && +- vlan_dev_vlan_id(attr->ndev) == vlan_id)) && ++ ((!vlan_id && !is_vlan_dev(ndev)) || ++ (vlan_id && is_vlan_dev(ndev) && ++ vlan_dev_vlan_id(ndev) == vlan_id)) && + attr->gid_type == IB_GID_TYPE_ROCE) { + rcu_read_unlock(); + if (gid) diff --git a/queue-5.4/net-tls-fix-corrupted-data-in-recvmsg.patch b/queue-5.4/net-tls-fix-corrupted-data-in-recvmsg.patch new file mode 100644 index 00000000000..762f12d8fce --- /dev/null +++ b/queue-5.4/net-tls-fix-corrupted-data-in-recvmsg.patch @@ -0,0 +1,37 @@ +From foo@baz Sun Nov 22 11:49:14 AM CET 2020 +From: Vadim Fedorenko +Date: Sun, 15 Nov 2020 07:16:00 +0300 +Subject: net/tls: fix corrupted data in recvmsg + +From: Vadim Fedorenko + +[ Upstream commit 3fe16edf6767decd640fa2654308bc64f8d656dc ] + +If tcp socket has more data than Encrypted Handshake Message then +tls_sw_recvmsg will try to decrypt next record instead of returning +full control message to userspace as mentioned in comment. The next +message - usually Application Data - gets corrupted because it uses +zero copy for decryption that's why the data is not stored in skb +for next iteration. Revert check to not decrypt next record if +current is not Application Data. + +Fixes: 692d7b5d1f91 ("tls: Fix recvmsg() to be able to peek across multiple records") +Signed-off-by: Vadim Fedorenko +Link: https://lore.kernel.org/r/1605413760-21153-1-git-send-email-vfedorenko@novek.ru +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/tls/tls_sw.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/tls/tls_sw.c ++++ b/net/tls/tls_sw.c +@@ -1907,7 +1907,7 @@ pick_next_record: + * another message type + */ + msg->msg_flags |= MSG_EOR; +- if (ctx->control != TLS_RECORD_TYPE_DATA) ++ if (control != TLS_RECORD_TYPE_DATA) + goto recv_end; + } else { + break; diff --git a/queue-5.4/net-usb-qmi_wwan-set-dtr-quirk-for-mr400.patch b/queue-5.4/net-usb-qmi_wwan-set-dtr-quirk-for-mr400.patch new file mode 100644 index 00000000000..2f9cc840171 --- /dev/null +++ b/queue-5.4/net-usb-qmi_wwan-set-dtr-quirk-for-mr400.patch @@ -0,0 +1,31 @@ +From foo@baz Sun Nov 22 11:49:14 AM CET 2020 +From: Filip Moc +Date: Tue, 17 Nov 2020 18:36:31 +0100 +Subject: net: usb: qmi_wwan: Set DTR quirk for MR400 + +From: Filip Moc + +[ Upstream commit df8d85d8c69d6837817e54dcb73c84a8b5a13877 ] + +LTE module MR400 embedded in TL-MR6400 v4 requires DTR to be set. + +Signed-off-by: Filip Moc +Acked-by: Bjørn Mork +Link: https://lore.kernel.org/r/20201117173631.GA550981@moc6.cz +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/usb/qmi_wwan.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -1092,7 +1092,7 @@ static const struct usb_device_id produc + {QMI_FIXED_INTF(0x05c6, 0x9011, 4)}, + {QMI_FIXED_INTF(0x05c6, 0x9021, 1)}, + {QMI_FIXED_INTF(0x05c6, 0x9022, 2)}, +- {QMI_FIXED_INTF(0x05c6, 0x9025, 4)}, /* Alcatel-sbell ASB TL131 TDD LTE (China Mobile) */ ++ {QMI_QUIRK_SET_DTR(0x05c6, 0x9025, 4)}, /* Alcatel-sbell ASB TL131 TDD LTE (China Mobile) */ + {QMI_FIXED_INTF(0x05c6, 0x9026, 3)}, + {QMI_FIXED_INTF(0x05c6, 0x902e, 5)}, + {QMI_FIXED_INTF(0x05c6, 0x9031, 5)}, diff --git a/queue-5.4/net-x25-increase-refcnt-of-struct-x25_neigh-in-x25_rx_call_request.patch b/queue-5.4/net-x25-increase-refcnt-of-struct-x25_neigh-in-x25_rx_call_request.patch new file mode 100644 index 00000000000..83a94efa096 --- /dev/null +++ b/queue-5.4/net-x25-increase-refcnt-of-struct-x25_neigh-in-x25_rx_call_request.patch @@ -0,0 +1,41 @@ +From foo@baz Sun Nov 22 11:49:14 AM CET 2020 +From: Xie He +Date: Thu, 12 Nov 2020 02:35:06 -0800 +Subject: net: x25: Increase refcnt of "struct x25_neigh" in x25_rx_call_request + +From: Xie He + +[ Upstream commit 4ee18c179e5e815fa5575e0d2db0c05795a804ee ] + +The x25_disconnect function in x25_subr.c would decrease the refcount of +"x25->neighbour" (struct x25_neigh) and reset this pointer to NULL. + +However, the x25_rx_call_request function in af_x25.c, which is called +when we receive a connection request, does not increase the refcount when +it assigns the pointer. + +Fix this issue by increasing the refcount of "struct x25_neigh" in +x25_rx_call_request. + +This patch fixes frequent kernel crashes when using AF_X25 sockets. + +Fixes: 4becb7ee5b3d ("net/x25: Fix x25_neigh refcnt leak when x25 disconnect") +Cc: Martin Schiller +Signed-off-by: Xie He +Link: https://lore.kernel.org/r/20201112103506.5875-1-xie.he.0141@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/x25/af_x25.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/net/x25/af_x25.c ++++ b/net/x25/af_x25.c +@@ -1044,6 +1044,7 @@ int x25_rx_call_request(struct sk_buff * + makex25->lci = lci; + makex25->dest_addr = dest_addr; + makex25->source_addr = source_addr; ++ x25_neigh_hold(nb); + makex25->neighbour = nb; + makex25->facilities = facilities; + makex25->dte_facilities= dte_facilities; diff --git a/queue-5.4/netlabel-fix-an-uninitialized-warning-in-netlbl_unlabel_staticlist.patch b/queue-5.4/netlabel-fix-an-uninitialized-warning-in-netlbl_unlabel_staticlist.patch new file mode 100644 index 00000000000..32bd010d298 --- /dev/null +++ b/queue-5.4/netlabel-fix-an-uninitialized-warning-in-netlbl_unlabel_staticlist.patch @@ -0,0 +1,35 @@ +From foo@baz Sun Nov 22 11:49:14 AM CET 2020 +From: Paul Moore +Date: Fri, 13 Nov 2020 16:30:40 -0500 +Subject: netlabel: fix an uninitialized warning in netlbl_unlabel_staticlist() + +From: Paul Moore + +[ Upstream commit 1ba86d4366e023d96df3dbe415eea7f1dc08c303 ] + +Static checking revealed that a previous fix to +netlbl_unlabel_staticlist() leaves a stack variable uninitialized, +this patches fixes that. + +Fixes: 866358ec331f ("netlabel: fix our progress tracking in netlbl_unlabel_staticlist()") +Reported-by: Dan Carpenter +Signed-off-by: Paul Moore +Reviewed-by: James Morris +Link: https://lore.kernel.org/r/160530304068.15651.18355773009751195447.stgit@sifl +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/netlabel/netlabel_unlabeled.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/netlabel/netlabel_unlabeled.c ++++ b/net/netlabel/netlabel_unlabeled.c +@@ -1166,7 +1166,7 @@ static int netlbl_unlabel_staticlist(str + u32 skip_bkt = cb->args[0]; + u32 skip_chain = cb->args[1]; + u32 skip_addr4 = cb->args[2]; +- u32 iter_bkt, iter_chain, iter_addr4 = 0, iter_addr6 = 0; ++ u32 iter_bkt, iter_chain = 0, iter_addr4 = 0, iter_addr6 = 0; + struct netlbl_unlhsh_iface *iface; + struct list_head *iter_list; + struct netlbl_af4list *addr4; diff --git a/queue-5.4/netlabel-fix-our-progress-tracking-in-netlbl_unlabel_staticlist.patch b/queue-5.4/netlabel-fix-our-progress-tracking-in-netlbl_unlabel_staticlist.patch new file mode 100644 index 00000000000..d3e6ea1cd0b --- /dev/null +++ b/queue-5.4/netlabel-fix-our-progress-tracking-in-netlbl_unlabel_staticlist.patch @@ -0,0 +1,89 @@ +From foo@baz Sun Nov 22 11:49:14 AM CET 2020 +From: Paul Moore +Date: Sun, 8 Nov 2020 09:08:26 -0500 +Subject: netlabel: fix our progress tracking in netlbl_unlabel_staticlist() + +From: Paul Moore + +[ Upstream commit 866358ec331f8faa394995fb4b511af1db0247c8 ] + +The current NetLabel code doesn't correctly keep track of the netlink +dump state in some cases, in particular when multiple interfaces with +large configurations are loaded. The problem manifests itself by not +reporting the full configuration to userspace, even though it is +loaded and active in the kernel. This patch fixes this by ensuring +that the dump state is properly reset when necessary inside the +netlbl_unlabel_staticlist() function. + +Fixes: 8cc44579d1bd ("NetLabel: Introduce static network labels for unlabeled connections") +Signed-off-by: Paul Moore +Link: https://lore.kernel.org/r/160484450633.3752.16512718263560813473.stgit@sifl +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/netlabel/netlabel_unlabeled.c | 17 ++++++++++++----- + 1 file changed, 12 insertions(+), 5 deletions(-) + +--- a/net/netlabel/netlabel_unlabeled.c ++++ b/net/netlabel/netlabel_unlabeled.c +@@ -1165,12 +1165,13 @@ static int netlbl_unlabel_staticlist(str + struct netlbl_unlhsh_walk_arg cb_arg; + u32 skip_bkt = cb->args[0]; + u32 skip_chain = cb->args[1]; +- u32 iter_bkt; +- u32 iter_chain = 0, iter_addr4 = 0, iter_addr6 = 0; ++ u32 skip_addr4 = cb->args[2]; ++ u32 iter_bkt, iter_chain, iter_addr4 = 0, iter_addr6 = 0; + struct netlbl_unlhsh_iface *iface; + struct list_head *iter_list; + struct netlbl_af4list *addr4; + #if IS_ENABLED(CONFIG_IPV6) ++ u32 skip_addr6 = cb->args[3]; + struct netlbl_af6list *addr6; + #endif + +@@ -1181,7 +1182,7 @@ static int netlbl_unlabel_staticlist(str + rcu_read_lock(); + for (iter_bkt = skip_bkt; + iter_bkt < rcu_dereference(netlbl_unlhsh)->size; +- iter_bkt++, iter_chain = 0, iter_addr4 = 0, iter_addr6 = 0) { ++ iter_bkt++) { + iter_list = &rcu_dereference(netlbl_unlhsh)->tbl[iter_bkt]; + list_for_each_entry_rcu(iface, iter_list, list) { + if (!iface->valid || +@@ -1189,7 +1190,7 @@ static int netlbl_unlabel_staticlist(str + continue; + netlbl_af4list_foreach_rcu(addr4, + &iface->addr4_list) { +- if (iter_addr4++ < cb->args[2]) ++ if (iter_addr4++ < skip_addr4) + continue; + if (netlbl_unlabel_staticlist_gen( + NLBL_UNLABEL_C_STATICLIST, +@@ -1202,10 +1203,12 @@ static int netlbl_unlabel_staticlist(str + goto unlabel_staticlist_return; + } + } ++ iter_addr4 = 0; ++ skip_addr4 = 0; + #if IS_ENABLED(CONFIG_IPV6) + netlbl_af6list_foreach_rcu(addr6, + &iface->addr6_list) { +- if (iter_addr6++ < cb->args[3]) ++ if (iter_addr6++ < skip_addr6) + continue; + if (netlbl_unlabel_staticlist_gen( + NLBL_UNLABEL_C_STATICLIST, +@@ -1218,8 +1221,12 @@ static int netlbl_unlabel_staticlist(str + goto unlabel_staticlist_return; + } + } ++ iter_addr6 = 0; ++ skip_addr6 = 0; + #endif /* IPv6 */ + } ++ iter_chain = 0; ++ skip_chain = 0; + } + + unlabel_staticlist_return: diff --git a/queue-5.4/page_frag-recover-from-memory-pressure.patch b/queue-5.4/page_frag-recover-from-memory-pressure.patch new file mode 100644 index 00000000000..f6a19a7ed40 --- /dev/null +++ b/queue-5.4/page_frag-recover-from-memory-pressure.patch @@ -0,0 +1,80 @@ +From foo@baz Sun Nov 22 11:49:14 AM CET 2020 +From: Dongli Zhang +Date: Sun, 15 Nov 2020 12:10:29 -0800 +Subject: page_frag: Recover from memory pressure + +From: Dongli Zhang + +[ Upstream commit d8c19014bba8f565d8a2f1f46b4e38d1d97bf1a7 ] + +The ethernet driver may allocate skb (and skb->data) via napi_alloc_skb(). +This ends up to page_frag_alloc() to allocate skb->data from +page_frag_cache->va. + +During the memory pressure, page_frag_cache->va may be allocated as +pfmemalloc page. As a result, the skb->pfmemalloc is always true as +skb->data is from page_frag_cache->va. The skb will be dropped if the +sock (receiver) does not have SOCK_MEMALLOC. This is expected behaviour +under memory pressure. + +However, once kernel is not under memory pressure any longer (suppose large +amount of memory pages are just reclaimed), the page_frag_alloc() may still +re-use the prior pfmemalloc page_frag_cache->va to allocate skb->data. As a +result, the skb->pfmemalloc is always true unless page_frag_cache->va is +re-allocated, even if the kernel is not under memory pressure any longer. + +Here is how kernel runs into issue. + +1. The kernel is under memory pressure and allocation of +PAGE_FRAG_CACHE_MAX_ORDER in __page_frag_cache_refill() will fail. Instead, +the pfmemalloc page is allocated for page_frag_cache->va. + +2: All skb->data from page_frag_cache->va (pfmemalloc) will have +skb->pfmemalloc=true. The skb will always be dropped by sock without +SOCK_MEMALLOC. This is an expected behaviour. + +3. Suppose a large amount of pages are reclaimed and kernel is not under +memory pressure any longer. We expect skb->pfmemalloc drop will not happen. + +4. Unfortunately, page_frag_alloc() does not proactively re-allocate +page_frag_alloc->va and will always re-use the prior pfmemalloc page. The +skb->pfmemalloc is always true even kernel is not under memory pressure any +longer. + +Fix this by freeing and re-allocating the page instead of recycling it. + +References: https://lore.kernel.org/lkml/20201103193239.1807-1-dongli.zhang@oracle.com/ +References: https://lore.kernel.org/linux-mm/20201105042140.5253-1-willy@infradead.org/ +Suggested-by: Matthew Wilcox (Oracle) +Cc: Aruna Ramakrishna +Cc: Bert Barbe +Cc: Rama Nichanamatlu +Cc: Venkat Venkatsubra +Cc: Manjunath Patil +Cc: Joe Jin +Cc: SRINIVAS +Fixes: 79930f5892e1 ("net: do not deplete pfmemalloc reserve") +Signed-off-by: Dongli Zhang +Acked-by: Vlastimil Babka +Reviewed-by: Eric Dumazet +Link: https://lore.kernel.org/r/20201115201029.11903-1-dongli.zhang@oracle.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + mm/page_alloc.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -4910,6 +4910,11 @@ refill: + if (!page_ref_sub_and_test(page, nc->pagecnt_bias)) + goto refill; + ++ if (unlikely(nc->pfmemalloc)) { ++ free_the_page(page, compound_order(page)); ++ goto refill; ++ } ++ + #if (PAGE_SIZE < PAGE_FRAG_CACHE_MAX_SIZE) + /* if size can vary use size else just use PAGE_SIZE */ + size = nc->size; diff --git a/queue-5.4/qed-fix-error-return-code-in-qed_iwarp_ll2_start.patch b/queue-5.4/qed-fix-error-return-code-in-qed_iwarp_ll2_start.patch new file mode 100644 index 00000000000..903ab80efb3 --- /dev/null +++ b/queue-5.4/qed-fix-error-return-code-in-qed_iwarp_ll2_start.patch @@ -0,0 +1,60 @@ +From foo@baz Sun Nov 22 11:49:14 AM CET 2020 +From: Zhang Changzhong +Date: Mon, 16 Nov 2020 21:07:13 +0800 +Subject: qed: fix error return code in qed_iwarp_ll2_start() + +From: Zhang Changzhong + +[ Upstream commit cb47d16ea21045c66eebbf5ed792e74a8537e27a ] + +Fix to return a negative error code from the error handling +case instead of 0, as done elsewhere in this function. + +Fixes: 469981b17a4f ("qed: Add unaligned and packed packet processing") +Fixes: fcb39f6c10b2 ("qed: Add mpa buffer descriptors for storing and processing mpa fpdus") +Fixes: 1e28eaad07ea ("qed: Add iWARP support for fpdu spanned over more than two tcp packets") +Reported-by: Hulk Robot +Signed-off-by: Zhang Changzhong +Acked-by: Michal Kalderon  +Link: https://lore.kernel.org/r/1605532033-27373-1-git-send-email-zhangchangzhong@huawei.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/qlogic/qed/qed_iwarp.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +--- a/drivers/net/ethernet/qlogic/qed/qed_iwarp.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_iwarp.c +@@ -2742,14 +2742,18 @@ qed_iwarp_ll2_start(struct qed_hwfn *p_h + iwarp_info->partial_fpdus = kcalloc((u16)p_hwfn->p_rdma_info->num_qps, + sizeof(*iwarp_info->partial_fpdus), + GFP_KERNEL); +- if (!iwarp_info->partial_fpdus) ++ if (!iwarp_info->partial_fpdus) { ++ rc = -ENOMEM; + goto err; ++ } + + iwarp_info->max_num_partial_fpdus = (u16)p_hwfn->p_rdma_info->num_qps; + + iwarp_info->mpa_intermediate_buf = kzalloc(buff_size, GFP_KERNEL); +- if (!iwarp_info->mpa_intermediate_buf) ++ if (!iwarp_info->mpa_intermediate_buf) { ++ rc = -ENOMEM; + goto err; ++ } + + /* The mpa_bufs array serves for pending RX packets received on the + * mpa ll2 that don't have place on the tx ring and require later +@@ -2759,8 +2763,10 @@ qed_iwarp_ll2_start(struct qed_hwfn *p_h + iwarp_info->mpa_bufs = kcalloc(data.input.rx_num_desc, + sizeof(*iwarp_info->mpa_bufs), + GFP_KERNEL); +- if (!iwarp_info->mpa_bufs) ++ if (!iwarp_info->mpa_bufs) { ++ rc = -ENOMEM; + goto err; ++ } + + INIT_LIST_HEAD(&iwarp_info->mpa_buf_pending_list); + INIT_LIST_HEAD(&iwarp_info->mpa_buf_list); diff --git a/queue-5.4/qlcnic-fix-error-return-code-in-qlcnic_83xx_restart_hw.patch b/queue-5.4/qlcnic-fix-error-return-code-in-qlcnic_83xx_restart_hw.patch new file mode 100644 index 00000000000..5795fcfdcd1 --- /dev/null +++ b/queue-5.4/qlcnic-fix-error-return-code-in-qlcnic_83xx_restart_hw.patch @@ -0,0 +1,34 @@ +From foo@baz Sun Nov 22 11:49:14 AM CET 2020 +From: Zhang Changzhong +Date: Fri, 13 Nov 2020 14:16:26 +0800 +Subject: qlcnic: fix error return code in qlcnic_83xx_restart_hw() + +From: Zhang Changzhong + +[ Upstream commit 3beb9be165083c2964eba1923601c3bfac0b02d4 ] + +Fix to return a negative error code from the error handling +case instead of 0, as done elsewhere in this function. + +Fixes: 3ced0a88cd4c ("qlcnic: Add support to run firmware POST") +Reported-by: Hulk Robot +Signed-off-by: Zhang Changzhong +Link: https://lore.kernel.org/r/1605248186-16013-1-git-send-email-zhangchangzhong@huawei.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c ++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c +@@ -2251,7 +2251,8 @@ static int qlcnic_83xx_restart_hw(struct + + /* Boot either flash image or firmware image from host file system */ + if (qlcnic_load_fw_file == 1) { +- if (qlcnic_83xx_load_fw_image_from_host(adapter)) ++ err = qlcnic_83xx_load_fw_image_from_host(adapter); ++ if (err) + return err; + } else { + QLC_SHARED_REG_WR32(adapter, QLCNIC_FW_IMG_VALID, diff --git a/queue-5.4/sctp-change-to-hold-put-transport-for-proto_unreach_timer.patch b/queue-5.4/sctp-change-to-hold-put-transport-for-proto_unreach_timer.patch new file mode 100644 index 00000000000..168182f6cd2 --- /dev/null +++ b/queue-5.4/sctp-change-to-hold-put-transport-for-proto_unreach_timer.patch @@ -0,0 +1,102 @@ +From foo@baz Sun Nov 22 11:49:14 AM CET 2020 +From: Xin Long +Date: Sat, 14 Nov 2020 13:22:53 +0800 +Subject: sctp: change to hold/put transport for proto_unreach_timer + +From: Xin Long + +[ Upstream commit 057a10fa1f73d745c8e69aa54ab147715f5630ae ] + +A call trace was found in Hangbin's Codenomicon testing with debug kernel: + + [ 2615.981988] ODEBUG: free active (active state 0) object type: timer_list hint: sctp_generate_proto_unreach_event+0x0/0x3a0 [sctp] + [ 2615.995050] WARNING: CPU: 17 PID: 0 at lib/debugobjects.c:328 debug_print_object+0x199/0x2b0 + [ 2616.095934] RIP: 0010:debug_print_object+0x199/0x2b0 + [ 2616.191533] Call Trace: + [ 2616.194265] + [ 2616.202068] debug_check_no_obj_freed+0x25e/0x3f0 + [ 2616.207336] slab_free_freelist_hook+0xeb/0x140 + [ 2616.220971] kfree+0xd6/0x2c0 + [ 2616.224293] rcu_do_batch+0x3bd/0xc70 + [ 2616.243096] rcu_core+0x8b9/0xd00 + [ 2616.256065] __do_softirq+0x23d/0xacd + [ 2616.260166] irq_exit+0x236/0x2a0 + [ 2616.263879] smp_apic_timer_interrupt+0x18d/0x620 + [ 2616.269138] apic_timer_interrupt+0xf/0x20 + [ 2616.273711] + +This is because it holds asoc when transport->proto_unreach_timer starts +and puts asoc when the timer stops, and without holding transport the +transport could be freed when the timer is still running. + +So fix it by holding/putting transport instead for proto_unreach_timer +in transport, just like other timers in transport. + +v1->v2: + - Also use sctp_transport_put() for the "out_unlock:" path in + sctp_generate_proto_unreach_event(), as Marcelo noticed. + +Fixes: 50b5d6ad6382 ("sctp: Fix a race between ICMP protocol unreachable and connect()") +Reported-by: Hangbin Liu +Signed-off-by: Xin Long +Acked-by: Marcelo Ricardo Leitner +Link: https://lore.kernel.org/r/102788809b554958b13b95d33440f5448113b8d6.1605331373.git.lucien.xin@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/sctp/input.c | 4 ++-- + net/sctp/sm_sideeffect.c | 4 ++-- + net/sctp/transport.c | 2 +- + 3 files changed, 5 insertions(+), 5 deletions(-) + +--- a/net/sctp/input.c ++++ b/net/sctp/input.c +@@ -449,7 +449,7 @@ void sctp_icmp_proto_unreachable(struct + else { + if (!mod_timer(&t->proto_unreach_timer, + jiffies + (HZ/20))) +- sctp_association_hold(asoc); ++ sctp_transport_hold(t); + } + } else { + struct net *net = sock_net(sk); +@@ -458,7 +458,7 @@ void sctp_icmp_proto_unreachable(struct + "encountered!\n", __func__); + + if (del_timer(&t->proto_unreach_timer)) +- sctp_association_put(asoc); ++ sctp_transport_put(t); + + sctp_do_sm(net, SCTP_EVENT_T_OTHER, + SCTP_ST_OTHER(SCTP_EVENT_ICMP_PROTO_UNREACH), +--- a/net/sctp/sm_sideeffect.c ++++ b/net/sctp/sm_sideeffect.c +@@ -419,7 +419,7 @@ void sctp_generate_proto_unreach_event(s + /* Try again later. */ + if (!mod_timer(&transport->proto_unreach_timer, + jiffies + (HZ/20))) +- sctp_association_hold(asoc); ++ sctp_transport_hold(transport); + goto out_unlock; + } + +@@ -435,7 +435,7 @@ void sctp_generate_proto_unreach_event(s + + out_unlock: + bh_unlock_sock(sk); +- sctp_association_put(asoc); ++ sctp_transport_put(transport); + } + + /* Handle the timeout of the RE-CONFIG timer. */ +--- a/net/sctp/transport.c ++++ b/net/sctp/transport.c +@@ -133,7 +133,7 @@ void sctp_transport_free(struct sctp_tra + + /* Delete the ICMP proto unreachable timer if it's active. */ + if (del_timer(&transport->proto_unreach_timer)) +- sctp_association_put(transport->asoc); ++ sctp_transport_put(transport); + + sctp_transport_put(transport); + } diff --git a/queue-5.4/series b/queue-5.4/series new file mode 100644 index 00000000000..b7134afe986 --- /dev/null +++ b/queue-5.4/series @@ -0,0 +1,33 @@ +ah6-fix-error-return-code-in-ah6_input.patch +atm-nicstar-unmap-dma-on-send-error.patch +bnxt_en-read-eeprom-a2h-address-using-page-0.patch +devlink-add-missing-genlmsg_cancel-in-devlink_nl_sb_port_pool_fill.patch +exempt-multicast-addresses-from-five-second-neighbor-lifetime.patch +inet_diag-fix-error-path-to-cancel-the-meseage-in-inet_req_diag_fill.patch +ipv6-fix-error-path-to-cancel-the-meseage.patch +lan743x-fix-issue-causing-intermittent-kernel-log-warnings.patch +lan743x-prevent-entire-kernel-hang-on-open-for-some-platforms.patch +mlxsw-core-use-variable-timeout-for-emad-retries.patch +net-b44-fix-error-return-code-in-b44_init_one.patch +net-bridge-add-missing-counters-to-ndo_get_stats64-callback.patch +net-dsa-mv88e6xxx-avoid-vtu-corruption-on-6097.patch +net-ethernet-ti-cpsw-fix-error-return-code-in-cpsw_probe.patch +net-have-netpoll-bring-up-dsa-management-interface.patch +netlabel-fix-our-progress-tracking-in-netlbl_unlabel_staticlist.patch +netlabel-fix-an-uninitialized-warning-in-netlbl_unlabel_staticlist.patch +net-lantiq-wait-for-the-gphy-firmware-to-be-ready.patch +net-mlx4_core-fix-init_hca-fields-offset.patch +net-qualcomm-rmnet-fix-incorrect-receive-packet-handling-during-cleanup.patch +net-smc-fix-direct-access-to-ib_gid_addr-ndev-in-smc_ib_determine_gid.patch +net-tls-fix-corrupted-data-in-recvmsg.patch +net-x25-increase-refcnt-of-struct-x25_neigh-in-x25_rx_call_request.patch +page_frag-recover-from-memory-pressure.patch +qed-fix-error-return-code-in-qed_iwarp_ll2_start.patch +qlcnic-fix-error-return-code-in-qlcnic_83xx_restart_hw.patch +sctp-change-to-hold-put-transport-for-proto_unreach_timer.patch +tcp-only-postpone-probe_rtt-if-rtt-is-current-min_rtt-estimate.patch +net-mlx5-add-handling-of-port-type-in-rule-deletion.patch +net-mlx5-disable-qos-when-min_rates-on-all-vfs-are-zero.patch +net-usb-qmi_wwan-set-dtr-quirk-for-mr400.patch +net-ncsi-fix-netlink-registration.patch +net-ftgmac100-fix-crash-when-removing-driver.patch diff --git a/queue-5.4/tcp-only-postpone-probe_rtt-if-rtt-is-current-min_rtt-estimate.patch b/queue-5.4/tcp-only-postpone-probe_rtt-if-rtt-is-current-min_rtt-estimate.patch new file mode 100644 index 00000000000..e288b541878 --- /dev/null +++ b/queue-5.4/tcp-only-postpone-probe_rtt-if-rtt-is-current-min_rtt-estimate.patch @@ -0,0 +1,46 @@ +From foo@baz Sun Nov 22 11:49:14 AM CET 2020 +From: Ryan Sharpelletti +Date: Mon, 16 Nov 2020 17:44:13 +0000 +Subject: tcp: only postpone PROBE_RTT if RTT is < current min_rtt estimate + +From: Ryan Sharpelletti + +[ Upstream commit 1b9e2a8c99a5c021041bfb2d512dc3ed92a94ffd ] + +During loss recovery, retransmitted packets are forced to use TCP +timestamps to calculate the RTT samples, which have a millisecond +granularity. BBR is designed using a microsecond granularity. As a +result, multiple RTT samples could be truncated to the same RTT value +during loss recovery. This is problematic, as BBR will not enter +PROBE_RTT if the RTT sample is <= the current min_rtt sample, meaning +that if there are persistent losses, PROBE_RTT will constantly be +pushed off and potentially never re-entered. This patch makes sure +that BBR enters PROBE_RTT by checking if RTT sample is < the current +min_rtt sample, rather than <=. + +The Netflix transport/TCP team discovered this bug in the Linux TCP +BBR code during lab tests. + +Fixes: 0f8782ea1497 ("tcp_bbr: add BBR congestion control") +Signed-off-by: Ryan Sharpelletti +Signed-off-by: Neal Cardwell +Signed-off-by: Soheil Hassas Yeganeh +Signed-off-by: Yuchung Cheng +Link: https://lore.kernel.org/r/20201116174412.1433277-1-sharpelletti.kdev@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/tcp_bbr.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/ipv4/tcp_bbr.c ++++ b/net/ipv4/tcp_bbr.c +@@ -945,7 +945,7 @@ static void bbr_update_min_rtt(struct so + filter_expired = after(tcp_jiffies32, + bbr->min_rtt_stamp + bbr_min_rtt_win_sec * HZ); + if (rs->rtt_us >= 0 && +- (rs->rtt_us <= bbr->min_rtt_us || ++ (rs->rtt_us < bbr->min_rtt_us || + (filter_expired && !rs->is_ack_delayed))) { + bbr->min_rtt_us = rs->rtt_us; + bbr->min_rtt_stamp = tcp_jiffies32;