From: Greg Kroah-Hartman Date: Mon, 15 Aug 2022 13:43:19 +0000 (+0200) Subject: 5.18-stable patches X-Git-Tag: v5.15.61~40 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=cec85f3dcef2e851454d0b9974e5e299d2b573f0;p=thirdparty%2Fkernel%2Fstable-queue.git 5.18-stable patches added patches: bpf-fix-sparse-warning-for-bpf_kptr_xchg_proto.patch bpf-suppress-passing-zero-to-ptr_err-warning.patch crypto-lib-blake2s-reduce-stack-frame-usage-in-self-test.patch drm-bridge-tc358767-fix-e-dp-bridge-endpoint-parsing-in-dedicated-function.patch drm-vc4-change-vc4_dma_range_matches-from-a-global-to-static.patch f2fs-fix-null-ptr-deref-in-f2fs_get_dnode_of_data.patch f2fs-revive-f2fs_ioc_abort_volatile_write.patch mptcp-refine-memory-scheduling.patch net-dsa-felix-fix-min-gate-len-calculation-for-tc-when-its-first-gate-is-closed.patch net-phy-smsc-disable-energy-detect-power-down-in-interrupt-mode.patch powerpc-kexec-fix-build-failure-from-uninitialised-variable.patch raw-fix-a-typo-in-raw_icmp_error.patch raw-remove-unused-variables-from-raw6_icmp_error.patch revert-mwifiex-fix-sleep-in-atomic-context-bugs-caused-by-dev_coredumpv.patch revert-s390-smp-enforce-lowcore-protection-on-cpu-restart.patch tcp-fix-over-estimation-in-sk_forced_mem_schedule.patch tracing-use-a-copy-of-the-va_list-for-__assign_vstr.patch --- diff --git a/queue-5.18/bpf-fix-sparse-warning-for-bpf_kptr_xchg_proto.patch b/queue-5.18/bpf-fix-sparse-warning-for-bpf_kptr_xchg_proto.patch new file mode 100644 index 00000000000..e91c29a6887 --- /dev/null +++ b/queue-5.18/bpf-fix-sparse-warning-for-bpf_kptr_xchg_proto.patch @@ -0,0 +1,37 @@ +From 5b74c690e1c55953ec99fd9dab74f72dbee4fe95 Mon Sep 17 00:00:00 2001 +From: Kumar Kartikeya Dwivedi +Date: Thu, 12 May 2022 01:16:51 +0530 +Subject: bpf: Fix sparse warning for bpf_kptr_xchg_proto + +From: Kumar Kartikeya Dwivedi + +commit 5b74c690e1c55953ec99fd9dab74f72dbee4fe95 upstream. + +Kernel Test Robot complained about missing static storage class +annotation for bpf_kptr_xchg_proto variable. + +sparse: symbol 'bpf_kptr_xchg_proto' was not declared. Should it be static? + +This caused by missing extern definition in the header. Add it to +suppress the sparse warning. + +Fixes: c0a5a21c25f3 ("bpf: Allow storing referenced kptr in map") +Reported-by: kernel test robot +Signed-off-by: Kumar Kartikeya Dwivedi +Link: https://lore.kernel.org/r/20220511194654.765705-2-memxor@gmail.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/bpf.h | 1 + + 1 file changed, 1 insertion(+) + +--- a/include/linux/bpf.h ++++ b/include/linux/bpf.h +@@ -2228,6 +2228,7 @@ extern const struct bpf_func_proto bpf_f + extern const struct bpf_func_proto bpf_loop_proto; + extern const struct bpf_func_proto bpf_strncmp_proto; + extern const struct bpf_func_proto bpf_copy_from_user_task_proto; ++extern const struct bpf_func_proto bpf_kptr_xchg_proto; + + const struct bpf_func_proto *tracing_prog_func_proto( + enum bpf_func_id func_id, const struct bpf_prog *prog); diff --git a/queue-5.18/bpf-suppress-passing-zero-to-ptr_err-warning.patch b/queue-5.18/bpf-suppress-passing-zero-to-ptr_err-warning.patch new file mode 100644 index 00000000000..74b3c2b22e6 --- /dev/null +++ b/queue-5.18/bpf-suppress-passing-zero-to-ptr_err-warning.patch @@ -0,0 +1,33 @@ +From 1ec5ee8c8a5a65ea377f8bea64bf4d5b743f6f79 Mon Sep 17 00:00:00 2001 +From: Kumar Kartikeya Dwivedi +Date: Sat, 21 May 2022 18:56:20 +0530 +Subject: bpf: Suppress 'passing zero to PTR_ERR' warning + +From: Kumar Kartikeya Dwivedi + +commit 1ec5ee8c8a5a65ea377f8bea64bf4d5b743f6f79 upstream. + +Kernel Test Robot complains about passing zero to PTR_ERR for the said +line, suppress it by using PTR_ERR_OR_ZERO. + +Fixes: c0a5a21c25f3 ("bpf: Allow storing referenced kptr in map") +Reported-by: kernel test robot +Signed-off-by: Kumar Kartikeya Dwivedi +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/20220521132620.1976921-1-memxor@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + kernel/bpf/verifier.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -5327,7 +5327,7 @@ static int process_kptr_func(struct bpf_ + return -EINVAL; + } + if (!map_value_has_kptrs(map_ptr)) { +- ret = PTR_ERR(map_ptr->kptr_off_tab); ++ ret = PTR_ERR_OR_ZERO(map_ptr->kptr_off_tab); + if (ret == -E2BIG) + verbose(env, "map '%s' has more than %d kptr\n", map_ptr->name, + BPF_MAP_VALUE_OFF_MAX); diff --git a/queue-5.18/crypto-lib-blake2s-reduce-stack-frame-usage-in-self-test.patch b/queue-5.18/crypto-lib-blake2s-reduce-stack-frame-usage-in-self-test.patch new file mode 100644 index 00000000000..098d5da4e18 --- /dev/null +++ b/queue-5.18/crypto-lib-blake2s-reduce-stack-frame-usage-in-self-test.patch @@ -0,0 +1,53 @@ +From d6c14da474bf260d73953fbf7992c98d9112aec7 Mon Sep 17 00:00:00 2001 +From: "Jason A. Donenfeld" +Date: Mon, 20 Jun 2022 09:52:43 +0200 +Subject: crypto: lib/blake2s - reduce stack frame usage in self test + +From: Jason A. Donenfeld + +commit d6c14da474bf260d73953fbf7992c98d9112aec7 upstream. + +Using 3 blocks here doesn't give us much more than using 2, and it +causes a stack frame size warning on certain compiler/config/arch +combinations: + + lib/crypto/blake2s-selftest.c: In function 'blake2s_selftest': +>> lib/crypto/blake2s-selftest.c:632:1: warning: the frame size of 1088 bytes is larger than 1024 bytes [-Wframe-larger-than=] + 632 | } + | ^ + +So this patch just reduces the block from 3 to 2, which makes the +warning go away. + +Reported-by: kernel test robot +Link: https://lore.kernel.org/linux-crypto/202206200851.gE3MHCgd-lkp@intel.com +Fixes: 2d16803c562e ("crypto: blake2s - remove shash module") +Signed-off-by: Jason A. Donenfeld +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman +--- + lib/crypto/blake2s-selftest.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/lib/crypto/blake2s-selftest.c ++++ b/lib/crypto/blake2s-selftest.c +@@ -593,7 +593,7 @@ bool __init blake2s_selftest(void) + enum { TEST_ALIGNMENT = 16 }; + u8 unaligned_block[BLAKE2S_BLOCK_SIZE + TEST_ALIGNMENT - 1] + __aligned(TEST_ALIGNMENT); +- u8 blocks[BLAKE2S_BLOCK_SIZE * 3]; ++ u8 blocks[BLAKE2S_BLOCK_SIZE * 2]; + struct blake2s_state state1, state2; + + get_random_bytes(blocks, sizeof(blocks)); +@@ -603,8 +603,8 @@ bool __init blake2s_selftest(void) + defined(CONFIG_CRYPTO_ARCH_HAVE_LIB_BLAKE2S) + memcpy(&state1, &state, sizeof(state1)); + memcpy(&state2, &state, sizeof(state2)); +- blake2s_compress(&state1, blocks, 3, BLAKE2S_BLOCK_SIZE); +- blake2s_compress_generic(&state2, blocks, 3, BLAKE2S_BLOCK_SIZE); ++ blake2s_compress(&state1, blocks, 2, BLAKE2S_BLOCK_SIZE); ++ blake2s_compress_generic(&state2, blocks, 2, BLAKE2S_BLOCK_SIZE); + if (memcmp(&state1, &state2, sizeof(state1))) { + pr_err("blake2s random compress self-test %d: FAIL\n", + i + 1); diff --git a/queue-5.18/drm-bridge-tc358767-fix-e-dp-bridge-endpoint-parsing-in-dedicated-function.patch b/queue-5.18/drm-bridge-tc358767-fix-e-dp-bridge-endpoint-parsing-in-dedicated-function.patch new file mode 100644 index 00000000000..042f0a8eba1 --- /dev/null +++ b/queue-5.18/drm-bridge-tc358767-fix-e-dp-bridge-endpoint-parsing-in-dedicated-function.patch @@ -0,0 +1,48 @@ +From 9030a9e571b3ba250d3d450a98310e3c74ecaff4 Mon Sep 17 00:00:00 2001 +From: Marek Vasut +Date: Thu, 28 Apr 2022 23:31:32 +0200 +Subject: drm/bridge: tc358767: Fix (e)DP bridge endpoint parsing in dedicated function + +From: Marek Vasut + +commit 9030a9e571b3ba250d3d450a98310e3c74ecaff4 upstream. + +Per toshiba,tc358767.yaml DT binding document, port@2 the output (e)DP +port is optional. In case this port is not described in DT, the bridge +driver operates in DPI-to-DP mode. The drm_of_find_panel_or_bridge() +call in tc_probe_edp_bridge_endpoint() returns -ENODEV in case port@2 +is not present in DT and this specific return value is incorrectly +propagated outside of tc_probe_edp_bridge_endpoint() function. All +other error values must be propagated and are propagated correctly. + +Return 0 in case the port@2 is missing instead, that reinstates the +original behavior before the commit this patch fixes. + +Fixes: 8478095a8c4b ("drm/bridge: tc358767: Move (e)DP bridge endpoint parsing into dedicated function") +Signed-off-by: Marek Vasut +Cc: Jonas Karlman +Cc: Laurent Pinchart +Cc: Lucas Stach +Cc: Marek Vasut +Cc: Maxime Ripard +Cc: Neil Armstrong +Cc: Robert Foss +Cc: Sam Ravnborg +Reviewed-by: Lucas Stach +Link: https://patchwork.freedesktop.org/patch/msgid/20220428213132.447890-1-marex@denx.de +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/bridge/tc358767.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/bridge/tc358767.c ++++ b/drivers/gpu/drm/bridge/tc358767.c +@@ -1573,7 +1573,7 @@ static int tc_probe_edp_bridge_endpoint( + tc->bridge.type = DRM_MODE_CONNECTOR_DisplayPort; + } + +- return ret; ++ return 0; + } + + static void tc_clk_disable(void *data) diff --git a/queue-5.18/drm-vc4-change-vc4_dma_range_matches-from-a-global-to-static.patch b/queue-5.18/drm-vc4-change-vc4_dma_range_matches-from-a-global-to-static.patch new file mode 100644 index 00000000000..146db2d7184 --- /dev/null +++ b/queue-5.18/drm-vc4-change-vc4_dma_range_matches-from-a-global-to-static.patch @@ -0,0 +1,35 @@ +From 63569d90863ff26c8b10c8971d1271c17a45224b Mon Sep 17 00:00:00 2001 +From: Tom Rix +Date: Wed, 29 Jun 2022 16:01:01 -0400 +Subject: drm/vc4: change vc4_dma_range_matches from a global to static + +From: Tom Rix + +commit 63569d90863ff26c8b10c8971d1271c17a45224b upstream. + +sparse reports +drivers/gpu/drm/vc4/vc4_drv.c:270:27: warning: symbol 'vc4_dma_range_matches' was not declared. Should it be static? + +vc4_dma_range_matches is only used in vc4_drv.c, so it's storage class specifier +should be static. + +Fixes: da8e393e23ef ("drm/vc4: drv: Adopt the dma configuration from the HVS or V3D component") +Signed-off-by: Tom Rix +Signed-off-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20220629200101.498138-1-trix@redhat.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/vc4/vc4_drv.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/vc4/vc4_drv.c ++++ b/drivers/gpu/drm/vc4/vc4_drv.c +@@ -209,7 +209,7 @@ static void vc4_match_add_drivers(struct + } + } + +-const struct of_device_id vc4_dma_range_matches[] = { ++static const struct of_device_id vc4_dma_range_matches[] = { + { .compatible = "brcm,bcm2711-hvs" }, + { .compatible = "brcm,bcm2835-hvs" }, + { .compatible = "brcm,bcm2835-v3d" }, diff --git a/queue-5.18/f2fs-fix-null-ptr-deref-in-f2fs_get_dnode_of_data.patch b/queue-5.18/f2fs-fix-null-ptr-deref-in-f2fs_get_dnode_of_data.patch new file mode 100644 index 00000000000..040cb6fe140 --- /dev/null +++ b/queue-5.18/f2fs-fix-null-ptr-deref-in-f2fs_get_dnode_of_data.patch @@ -0,0 +1,115 @@ +From 4a2c5b7994960fac29cf8a3f4e62855bae1b27d4 Mon Sep 17 00:00:00 2001 +From: Ye Bin +Date: Mon, 1 Aug 2022 19:26:04 +0800 +Subject: f2fs: fix null-ptr-deref in f2fs_get_dnode_of_data + +From: Ye Bin + +commit 4a2c5b7994960fac29cf8a3f4e62855bae1b27d4 upstream. + +There is issue as follows when test f2fs atomic write: +F2FS-fs (loop0): Can't find valid F2FS filesystem in 2th superblock +F2FS-fs (loop0): invalid crc_offset: 0 +F2FS-fs (loop0): f2fs_check_nid_range: out-of-range nid=1, run fsck to fix. +F2FS-fs (loop0): f2fs_check_nid_range: out-of-range nid=2, run fsck to fix. +================================================================== +BUG: KASAN: null-ptr-deref in f2fs_get_dnode_of_data+0xac/0x16d0 +Read of size 8 at addr 0000000000000028 by task rep/1990 + +CPU: 4 PID: 1990 Comm: rep Not tainted 5.19.0-rc6-next-20220715 #266 +Call Trace: + + dump_stack_lvl+0x6e/0x91 + print_report.cold+0x49a/0x6bb + kasan_report+0xa8/0x130 + f2fs_get_dnode_of_data+0xac/0x16d0 + f2fs_do_write_data_page+0x2a5/0x1030 + move_data_page+0x3c5/0xdf0 + do_garbage_collect+0x2015/0x36c0 + f2fs_gc+0x554/0x1d30 + f2fs_balance_fs+0x7f5/0xda0 + f2fs_write_single_data_page+0xb66/0xdc0 + f2fs_write_cache_pages+0x716/0x1420 + f2fs_write_data_pages+0x84f/0x9a0 + do_writepages+0x130/0x3a0 + filemap_fdatawrite_wbc+0x87/0xa0 + file_write_and_wait_range+0x157/0x1c0 + f2fs_do_sync_file+0x206/0x12d0 + f2fs_sync_file+0x99/0xc0 + vfs_fsync_range+0x75/0x140 + f2fs_file_write_iter+0xd7b/0x1850 + vfs_write+0x645/0x780 + ksys_write+0xf1/0x1e0 + do_syscall_64+0x3b/0x90 + entry_SYSCALL_64_after_hwframe+0x63/0xcd + +As 3db1de0e582c commit changed atomic write way which new a cow_inode for +atomic write file, and also mark cow_inode as FI_ATOMIC_FILE. +When f2fs_do_write_data_page write cow_inode will use cow_inode's cow_inode +which is NULL. Then will trigger null-ptr-deref. +To solve above issue, introduce FI_COW_FILE flag for COW inode. + +Fiexes: 3db1de0e582c("f2fs: change the current atomic write way") +Signed-off-by: Ye Bin +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Greg Kroah-Hartman +--- + fs/f2fs/f2fs.h | 6 ++++++ + fs/f2fs/file.c | 2 +- + fs/f2fs/segment.c | 4 ++-- + 3 files changed, 9 insertions(+), 3 deletions(-) + +--- a/fs/f2fs/f2fs.h ++++ b/fs/f2fs/f2fs.h +@@ -756,6 +756,7 @@ enum { + FI_ENABLE_COMPRESS, /* enable compression in "user" compression mode */ + FI_COMPRESS_RELEASED, /* compressed blocks were released */ + FI_ALIGNED_WRITE, /* enable aligned write */ ++ FI_COW_FILE, /* indicate COW file */ + FI_MAX, /* max flag, never be used */ + }; + +@@ -3188,6 +3189,11 @@ static inline bool f2fs_is_atomic_file(s + return is_inode_flag_set(inode, FI_ATOMIC_FILE); + } + ++static inline bool f2fs_is_cow_file(struct inode *inode) ++{ ++ return is_inode_flag_set(inode, FI_COW_FILE); ++} ++ + static inline bool f2fs_is_first_block_written(struct inode *inode) + { + return is_inode_flag_set(inode, FI_FIRST_BLOCK_WRITTEN); +--- a/fs/f2fs/file.c ++++ b/fs/f2fs/file.c +@@ -2055,7 +2055,7 @@ static int f2fs_ioc_start_atomic_write(s + spin_unlock(&sbi->inode_lock[ATOMIC_FILE]); + + set_inode_flag(inode, FI_ATOMIC_FILE); +- set_inode_flag(fi->cow_inode, FI_ATOMIC_FILE); ++ set_inode_flag(fi->cow_inode, FI_COW_FILE); + clear_inode_flag(fi->cow_inode, FI_INLINE_DATA); + f2fs_up_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]); + +--- a/fs/f2fs/segment.c ++++ b/fs/f2fs/segment.c +@@ -193,7 +193,7 @@ void f2fs_abort_atomic_write(struct inod + if (f2fs_is_atomic_file(inode)) { + if (clean) + truncate_inode_pages_final(inode->i_mapping); +- clear_inode_flag(fi->cow_inode, FI_ATOMIC_FILE); ++ clear_inode_flag(fi->cow_inode, FI_COW_FILE); + iput(fi->cow_inode); + fi->cow_inode = NULL; + clear_inode_flag(inode, FI_ATOMIC_FILE); +@@ -3167,7 +3167,7 @@ static int __get_segment_type_6(struct f + return CURSEG_COLD_DATA; + if (file_is_hot(inode) || + is_inode_flag_set(inode, FI_HOT_DATA) || +- f2fs_is_atomic_file(inode)) ++ f2fs_is_cow_file(inode)) + return CURSEG_HOT_DATA; + return f2fs_rw_hint_to_seg_type(inode->i_write_hint); + } else { diff --git a/queue-5.18/f2fs-revive-f2fs_ioc_abort_volatile_write.patch b/queue-5.18/f2fs-revive-f2fs_ioc_abort_volatile_write.patch new file mode 100644 index 00000000000..624948f44e6 --- /dev/null +++ b/queue-5.18/f2fs-revive-f2fs_ioc_abort_volatile_write.patch @@ -0,0 +1,89 @@ +From 23339e5752d01a4b5e122759b002cf896d26f6c1 Mon Sep 17 00:00:00 2001 +From: Daeho Jeong +Date: Mon, 1 Aug 2022 10:08:08 -0700 +Subject: f2fs: revive F2FS_IOC_ABORT_VOLATILE_WRITE + +From: Daeho Jeong + +commit 23339e5752d01a4b5e122759b002cf896d26f6c1 upstream. + +F2FS_IOC_ABORT_VOLATILE_WRITE was used to abort a atomic write before. +However it was removed accidentally. So revive it by changing the name, +since volatile write had gone. + +Signed-off-by: Daeho Jeong +Fiexes: 7bc155fec5b3("f2fs: kill volatile write support") +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Greg Kroah-Hartman +--- + fs/f2fs/file.c | 30 ++++++++++++++++++++++++++++-- + include/uapi/linux/f2fs.h | 2 +- + 2 files changed, 29 insertions(+), 3 deletions(-) + +--- a/fs/f2fs/file.c ++++ b/fs/f2fs/file.c +@@ -2102,6 +2102,31 @@ unlock_out: + return ret; + } + ++static int f2fs_ioc_abort_atomic_write(struct file *filp) ++{ ++ struct inode *inode = file_inode(filp); ++ struct user_namespace *mnt_userns = file_mnt_user_ns(filp); ++ int ret; ++ ++ if (!inode_owner_or_capable(mnt_userns, inode)) ++ return -EACCES; ++ ++ ret = mnt_want_write_file(filp); ++ if (ret) ++ return ret; ++ ++ inode_lock(inode); ++ ++ if (f2fs_is_atomic_file(inode)) ++ f2fs_abort_atomic_write(inode, true); ++ ++ inode_unlock(inode); ++ ++ mnt_drop_write_file(filp); ++ f2fs_update_time(F2FS_I_SB(inode), REQ_TIME); ++ return ret; ++} ++ + static int f2fs_ioc_shutdown(struct file *filp, unsigned long arg) + { + struct inode *inode = file_inode(filp); +@@ -4039,9 +4064,10 @@ static long __f2fs_ioctl(struct file *fi + return f2fs_ioc_start_atomic_write(filp); + case F2FS_IOC_COMMIT_ATOMIC_WRITE: + return f2fs_ioc_commit_atomic_write(filp); ++ case F2FS_IOC_ABORT_ATOMIC_WRITE: ++ return f2fs_ioc_abort_atomic_write(filp); + case F2FS_IOC_START_VOLATILE_WRITE: + case F2FS_IOC_RELEASE_VOLATILE_WRITE: +- case F2FS_IOC_ABORT_VOLATILE_WRITE: + return -EOPNOTSUPP; + case F2FS_IOC_SHUTDOWN: + return f2fs_ioc_shutdown(filp, arg); +@@ -4666,7 +4692,7 @@ long f2fs_compat_ioctl(struct file *file + case F2FS_IOC_COMMIT_ATOMIC_WRITE: + case F2FS_IOC_START_VOLATILE_WRITE: + case F2FS_IOC_RELEASE_VOLATILE_WRITE: +- case F2FS_IOC_ABORT_VOLATILE_WRITE: ++ case F2FS_IOC_ABORT_ATOMIC_WRITE: + case F2FS_IOC_SHUTDOWN: + case FITRIM: + case FS_IOC_SET_ENCRYPTION_POLICY: +--- a/include/uapi/linux/f2fs.h ++++ b/include/uapi/linux/f2fs.h +@@ -13,7 +13,7 @@ + #define F2FS_IOC_COMMIT_ATOMIC_WRITE _IO(F2FS_IOCTL_MAGIC, 2) + #define F2FS_IOC_START_VOLATILE_WRITE _IO(F2FS_IOCTL_MAGIC, 3) + #define F2FS_IOC_RELEASE_VOLATILE_WRITE _IO(F2FS_IOCTL_MAGIC, 4) +-#define F2FS_IOC_ABORT_VOLATILE_WRITE _IO(F2FS_IOCTL_MAGIC, 5) ++#define F2FS_IOC_ABORT_ATOMIC_WRITE _IO(F2FS_IOCTL_MAGIC, 5) + #define F2FS_IOC_GARBAGE_COLLECT _IOW(F2FS_IOCTL_MAGIC, 6, __u32) + #define F2FS_IOC_WRITE_CHECKPOINT _IO(F2FS_IOCTL_MAGIC, 7) + #define F2FS_IOC_DEFRAGMENT _IOWR(F2FS_IOCTL_MAGIC, 8, \ diff --git a/queue-5.18/mptcp-refine-memory-scheduling.patch b/queue-5.18/mptcp-refine-memory-scheduling.patch new file mode 100644 index 00000000000..4980a58bca3 --- /dev/null +++ b/queue-5.18/mptcp-refine-memory-scheduling.patch @@ -0,0 +1,35 @@ +From 69d93daec026cdda98e29e8edb12534bfa5b1a9b Mon Sep 17 00:00:00 2001 +From: Paolo Abeni +Date: Thu, 30 Jun 2022 15:17:56 -0700 +Subject: mptcp: refine memory scheduling + +From: Paolo Abeni + +commit 69d93daec026cdda98e29e8edb12534bfa5b1a9b upstream. + +Similar to commit 7c80b038d23e ("net: fix sk_wmem_schedule() and +sk_rmem_schedule() errors"), let the MPTCP receive path schedule +exactly the required amount of memory. + +Signed-off-by: Paolo Abeni +Signed-off-by: Mat Martineau +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/mptcp/protocol.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/net/mptcp/protocol.c ++++ b/net/mptcp/protocol.c +@@ -323,9 +323,10 @@ static bool mptcp_rmem_schedule(struct s + struct mptcp_sock *msk = mptcp_sk(sk); + int amt, amount; + +- if (size < msk->rmem_fwd_alloc) ++ if (size <= msk->rmem_fwd_alloc) + return true; + ++ size -= msk->rmem_fwd_alloc; + amt = sk_mem_pages(size); + amount = amt << SK_MEM_QUANTUM_SHIFT; + msk->rmem_fwd_alloc += amount; diff --git a/queue-5.18/net-dsa-felix-fix-min-gate-len-calculation-for-tc-when-its-first-gate-is-closed.patch b/queue-5.18/net-dsa-felix-fix-min-gate-len-calculation-for-tc-when-its-first-gate-is-closed.patch new file mode 100644 index 00000000000..75a466d850f --- /dev/null +++ b/queue-5.18/net-dsa-felix-fix-min-gate-len-calculation-for-tc-when-its-first-gate-is-closed.patch @@ -0,0 +1,87 @@ +From 7e4babffa6f340a74c820d44d44d16511e666424 Mon Sep 17 00:00:00 2001 +From: Vladimir Oltean +Date: Thu, 4 Aug 2022 23:28:17 +0300 +Subject: net: dsa: felix: fix min gate len calculation for tc when its first gate is closed + +From: Vladimir Oltean + +commit 7e4babffa6f340a74c820d44d44d16511e666424 upstream. + +min_gate_len[tc] is supposed to track the shortest interval of +continuously open gates for a traffic class. For example, in the +following case: + +TC 76543210 + +t0 00000001b 200000 ns +t1 00000010b 200000 ns + +min_gate_len[0] and min_gate_len[1] should be 200000, while +min_gate_len[2-7] should be 0. + +However what happens is that min_gate_len[0] is 200000, but +min_gate_len[1] ends up being 0 (despite gate_len[1] being 200000 at the +point where the logic detects the gate close event for TC 1). + +The problem is that the code considers a "gate close" event whenever it +sees that there is a 0 for that TC (essentially it's level rather than +edge triggered). By doing that, any time a gate is seen as closed +without having been open prior, gate_len, which is 0, will be written +into min_gate_len. Once min_gate_len becomes 0, it's impossible for it +to track anything higher than that (the length of actually open +intervals). + +To fix this, we make the writing to min_gate_len[tc] be edge-triggered, +which avoids writes for gates that are closed in consecutive intervals. +However what this does is it makes us need to special-case the +permanently closed gates at the end. + +Fixes: 55a515b1f5a9 ("net: dsa: felix: drop oversized frames with tc-taprio instead of hanging the port") +Signed-off-by: Vladimir Oltean +Link: https://lore.kernel.org/r/20220804202817.1677572-1-vladimir.oltean@nxp.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/dsa/ocelot/felix_vsc9959.c | 15 ++++++++++++++- + 1 file changed, 14 insertions(+), 1 deletion(-) + +--- a/drivers/net/dsa/ocelot/felix_vsc9959.c ++++ b/drivers/net/dsa/ocelot/felix_vsc9959.c +@@ -1133,6 +1133,7 @@ static void vsc9959_tas_min_gate_lengths + { + struct tc_taprio_sched_entry *entry; + u64 gate_len[OCELOT_NUM_TC]; ++ u8 gates_ever_opened = 0; + int tc, i, n; + + /* Initialize arrays */ +@@ -1160,16 +1161,28 @@ static void vsc9959_tas_min_gate_lengths + for (tc = 0; tc < OCELOT_NUM_TC; tc++) { + if (entry->gate_mask & BIT(tc)) { + gate_len[tc] += entry->interval; ++ gates_ever_opened |= BIT(tc); + } else { + /* Gate closes now, record a potential new + * minimum and reinitialize length + */ +- if (min_gate_len[tc] > gate_len[tc]) ++ if (min_gate_len[tc] > gate_len[tc] && ++ gate_len[tc]) + min_gate_len[tc] = gate_len[tc]; + gate_len[tc] = 0; + } + } + } ++ ++ /* min_gate_len[tc] actually tracks minimum *open* gate time, so for ++ * permanently closed gates, min_gate_len[tc] will still be U64_MAX. ++ * Therefore they are currently indistinguishable from permanently ++ * open gates. Overwrite the gate len with 0 when we know they're ++ * actually permanently closed, i.e. after the loop above. ++ */ ++ for (tc = 0; tc < OCELOT_NUM_TC; tc++) ++ if (!(gates_ever_opened & BIT(tc))) ++ min_gate_len[tc] = 0; + } + + /* Update QSYS_PORT_MAX_SDU to make sure the static guard bands added by the diff --git a/queue-5.18/net-phy-smsc-disable-energy-detect-power-down-in-interrupt-mode.patch b/queue-5.18/net-phy-smsc-disable-energy-detect-power-down-in-interrupt-mode.patch new file mode 100644 index 00000000000..4548108e21f --- /dev/null +++ b/queue-5.18/net-phy-smsc-disable-energy-detect-power-down-in-interrupt-mode.patch @@ -0,0 +1,64 @@ +From 2642cc6c3bbe0900ba15bab078fd15ad8baccbc5 Mon Sep 17 00:00:00 2001 +From: Lukas Wunner +Date: Mon, 20 Jun 2022 13:04:50 +0200 +Subject: net: phy: smsc: Disable Energy Detect Power-Down in interrupt mode + +From: Lukas Wunner + +commit 2642cc6c3bbe0900ba15bab078fd15ad8baccbc5 upstream. + +Simon reports that if two LAN9514 USB adapters are directly connected +without an intermediate switch, the link fails to come up and link LEDs +remain dark. The issue was introduced by commit 1ce8b37241ed ("usbnet: +smsc95xx: Forward PHY interrupts to PHY driver to avoid polling"). + +The PHY suffers from a known erratum wherein link detection becomes +unreliable if Energy Detect Power-Down is used. In poll mode, the +driver works around the erratum by briefly disabling EDPD for 640 msec +to detect a neighbor, then re-enabling it to save power. + +In interrupt mode, no interrupt is signaled if EDPD is used by both link +partners, so it must not be enabled at all. + +We'll recoup the power savings by enabling SUSPEND1 mode on affected +LAN95xx chips in a forthcoming commit. + +Fixes: 1ce8b37241ed ("usbnet: smsc95xx: Forward PHY interrupts to PHY driver to avoid polling") +Reported-by: Simon Han +Signed-off-by: Lukas Wunner +Link: https://lore.kernel.org/r/439a3f3168c2f9d44b5fd9bb8d2b551711316be6.1655714438.git.lukas@wunner.de +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/phy/smsc.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/net/phy/smsc.c ++++ b/drivers/net/phy/smsc.c +@@ -110,7 +110,7 @@ static int smsc_phy_config_init(struct p + struct smsc_phy_priv *priv = phydev->priv; + int rc; + +- if (!priv->energy_enable) ++ if (!priv->energy_enable || phydev->irq != PHY_POLL) + return 0; + + rc = phy_read(phydev, MII_LAN83C185_CTRL_STATUS); +@@ -210,6 +210,8 @@ static int lan95xx_config_aneg_ext(struc + * response on link pulses to detect presence of plugged Ethernet cable. + * The Energy Detect Power-Down mode is enabled again in the end of procedure to + * save approximately 220 mW of power if cable is unplugged. ++ * The workaround is only applicable to poll mode. Energy Detect Power-Down may ++ * not be used in interrupt mode lest link change detection becomes unreliable. + */ + static int lan87xx_read_status(struct phy_device *phydev) + { +@@ -217,7 +219,7 @@ static int lan87xx_read_status(struct ph + + int err = genphy_read_status(phydev); + +- if (!phydev->link && priv->energy_enable) { ++ if (!phydev->link && priv->energy_enable && phydev->irq == PHY_POLL) { + /* Disable EDPD to wake up PHY */ + int rc = phy_read(phydev, MII_LAN83C185_CTRL_STATUS); + if (rc < 0) diff --git a/queue-5.18/powerpc-kexec-fix-build-failure-from-uninitialised-variable.patch b/queue-5.18/powerpc-kexec-fix-build-failure-from-uninitialised-variable.patch new file mode 100644 index 00000000000..b078a655deb --- /dev/null +++ b/queue-5.18/powerpc-kexec-fix-build-failure-from-uninitialised-variable.patch @@ -0,0 +1,48 @@ +From 83ee9f23763a432a4077bf20624ee35de87bce99 Mon Sep 17 00:00:00 2001 +From: Russell Currey +Date: Wed, 10 Aug 2022 15:43:31 +1000 +Subject: powerpc/kexec: Fix build failure from uninitialised variable + +From: Russell Currey + +commit 83ee9f23763a432a4077bf20624ee35de87bce99 upstream. + +clang 14 won't build because ret is uninitialised and can be returned if +both prop and fdtprop are NULL. Drop the ret variable and return an +error in that failure case. + +Fixes: b1fc44eaa9ba ("pseries/iommu/ddw: Fix kdump to work in absence of ibm,dma-window") +Suggested-by: Christophe Leroy +Signed-off-by: Russell Currey +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20220810054331.373761-1-ruscur@russell.cc +Signed-off-by: Greg Kroah-Hartman +--- + arch/powerpc/kexec/file_load_64.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/arch/powerpc/kexec/file_load_64.c ++++ b/arch/powerpc/kexec/file_load_64.c +@@ -1043,17 +1043,17 @@ static int copy_property(void *fdt, int + const char *propname) + { + const void *prop, *fdtprop; +- int len = 0, fdtlen = 0, ret; ++ int len = 0, fdtlen = 0; + + prop = of_get_property(dn, propname, &len); + fdtprop = fdt_getprop(fdt, node_offset, propname, &fdtlen); + + if (fdtprop && !prop) +- ret = fdt_delprop(fdt, node_offset, propname); ++ return fdt_delprop(fdt, node_offset, propname); + else if (prop) +- ret = fdt_setprop(fdt, node_offset, propname, prop, len); +- +- return ret; ++ return fdt_setprop(fdt, node_offset, propname, prop, len); ++ else ++ return -FDT_ERR_NOTFOUND; + } + + static int update_pci_dma_nodes(void *fdt, const char *dmapropname) diff --git a/queue-5.18/raw-fix-a-typo-in-raw_icmp_error.patch b/queue-5.18/raw-fix-a-typo-in-raw_icmp_error.patch new file mode 100644 index 00000000000..546666828c1 --- /dev/null +++ b/queue-5.18/raw-fix-a-typo-in-raw_icmp_error.patch @@ -0,0 +1,36 @@ +From 97a4d46b1516250d640c1ae0c9e7129d160d6a1c Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Thu, 23 Jun 2022 19:35:40 +0000 +Subject: raw: fix a typo in raw_icmp_error() + +From: Eric Dumazet + +commit 97a4d46b1516250d640c1ae0c9e7129d160d6a1c upstream. + +I accidentally broke IPv4 traceroute, by swapping iph->saddr +and iph->daddr. + +Probably because raw_icmp_error() and raw_v4_input() +use different order for iph->saddr and iph->daddr. + +Fixes: ba44f8182ec2 ("raw: use more conventional iterators") +Reported-by: John Sperbeck +Signed-off-by: Eric Dumazet +Link: https://lore.kernel.org/r/20220623193540.2851799-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/raw.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/ipv4/raw.c ++++ b/net/ipv4/raw.c +@@ -278,7 +278,7 @@ void raw_icmp_error(struct sk_buff *skb, + hlist_nulls_for_each_entry(sk, hnode, hlist, sk_nulls_node) { + iph = (const struct iphdr *)skb->data; + if (!raw_v4_match(net, sk, iph->protocol, +- iph->saddr, iph->daddr, dif, sdif)) ++ iph->daddr, iph->saddr, dif, sdif)) + continue; + raw_err(sk, skb, info); + } diff --git a/queue-5.18/raw-remove-unused-variables-from-raw6_icmp_error.patch b/queue-5.18/raw-remove-unused-variables-from-raw6_icmp_error.patch new file mode 100644 index 00000000000..db433ab35f0 --- /dev/null +++ b/queue-5.18/raw-remove-unused-variables-from-raw6_icmp_error.patch @@ -0,0 +1,41 @@ +From c4fceb46add65481ef0dfb79cad24c3c269b4cad Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Wed, 22 Jun 2022 03:23:03 +0000 +Subject: raw: remove unused variables from raw6_icmp_error() + +From: Eric Dumazet + +commit c4fceb46add65481ef0dfb79cad24c3c269b4cad upstream. + +saddr and daddr are set but not used. + +Fixes: ba44f8182ec2 ("raw: use more conventional iterators") +Reported-by: kernel test robot +Signed-off-by: Eric Dumazet +Acked-by: Jonathan Lemon +Link: https://lore.kernel.org/r/20220622032303.159394-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/raw.c | 3 --- + 1 file changed, 3 deletions(-) + +--- a/net/ipv6/raw.c ++++ b/net/ipv6/raw.c +@@ -332,7 +332,6 @@ static void rawv6_err(struct sock *sk, s + void raw6_icmp_error(struct sk_buff *skb, int nexthdr, + u8 type, u8 code, int inner_offset, __be32 info) + { +- const struct in6_addr *saddr, *daddr; + struct net *net = dev_net(skb->dev); + struct hlist_nulls_head *hlist; + struct hlist_nulls_node *hnode; +@@ -345,8 +344,6 @@ void raw6_icmp_error(struct sk_buff *skb + hlist_nulls_for_each_entry(sk, hnode, hlist, sk_nulls_node) { + /* Note: ipv6_hdr(skb) != skb->data */ + const struct ipv6hdr *ip6h = (const struct ipv6hdr *)skb->data; +- saddr = &ip6h->saddr; +- daddr = &ip6h->daddr; + + if (!raw_v6_match(net, sk, nexthdr, &ip6h->saddr, &ip6h->daddr, + inet6_iif(skb), inet6_iif(skb))) diff --git a/queue-5.18/revert-mwifiex-fix-sleep-in-atomic-context-bugs-caused-by-dev_coredumpv.patch b/queue-5.18/revert-mwifiex-fix-sleep-in-atomic-context-bugs-caused-by-dev_coredumpv.patch new file mode 100644 index 00000000000..f3d38f35ae8 --- /dev/null +++ b/queue-5.18/revert-mwifiex-fix-sleep-in-atomic-context-bugs-caused-by-dev_coredumpv.patch @@ -0,0 +1,100 @@ +From 5f8954e099b8ae96e7de1bb95950e00c85bedd40 Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman +Date: Mon, 27 Jun 2022 16:35:59 +0200 +Subject: Revert "mwifiex: fix sleep in atomic context bugs caused by dev_coredumpv" + +From: Greg Kroah-Hartman + +commit 5f8954e099b8ae96e7de1bb95950e00c85bedd40 upstream. + +This reverts commit a52ed4866d2b90dd5e4ae9dabd453f3ed8fa3cbc as it +causes build problems in linux-next. It needs to be reintroduced in a +way that can allow the api to evolve and not require a "flag day" to +catch all users. + +Link: https://lore.kernel.org/r/20220623160723.7a44b573@canb.auug.org.au +Cc: Duoming Zhou +Cc: Brian Norris +Cc: Johannes Berg +Reported-by: Stephen Rothwell +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/marvell/mwifiex/init.c | 9 ++++----- + drivers/net/wireless/marvell/mwifiex/main.h | 3 +-- + drivers/net/wireless/marvell/mwifiex/sta_event.c | 6 +++--- + 3 files changed, 8 insertions(+), 10 deletions(-) + +--- a/drivers/net/wireless/marvell/mwifiex/init.c ++++ b/drivers/net/wireless/marvell/mwifiex/init.c +@@ -63,10 +63,9 @@ static void wakeup_timer_fn(struct timer + adapter->if_ops.card_reset(adapter); + } + +-static void fw_dump_work(struct work_struct *work) ++static void fw_dump_timer_fn(struct timer_list *t) + { +- struct mwifiex_adapter *adapter = +- container_of(work, struct mwifiex_adapter, devdump_work.work); ++ struct mwifiex_adapter *adapter = from_timer(adapter, t, devdump_timer); + + mwifiex_upload_device_dump(adapter); + } +@@ -322,7 +321,7 @@ static void mwifiex_init_adapter(struct + adapter->active_scan_triggered = false; + timer_setup(&adapter->wakeup_timer, wakeup_timer_fn, 0); + adapter->devdump_len = 0; +- INIT_DELAYED_WORK(&adapter->devdump_work, fw_dump_work); ++ timer_setup(&adapter->devdump_timer, fw_dump_timer_fn, 0); + } + + /* +@@ -401,7 +400,7 @@ static void + mwifiex_adapter_cleanup(struct mwifiex_adapter *adapter) + { + del_timer(&adapter->wakeup_timer); +- cancel_delayed_work_sync(&adapter->devdump_work); ++ del_timer_sync(&adapter->devdump_timer); + mwifiex_cancel_all_pending_cmd(adapter); + wake_up_interruptible(&adapter->cmd_wait_q.wait); + wake_up_interruptible(&adapter->hs_activate_wait_q); +--- a/drivers/net/wireless/marvell/mwifiex/main.h ++++ b/drivers/net/wireless/marvell/mwifiex/main.h +@@ -49,7 +49,6 @@ + #include + #include + #include +-#include + + #include "decl.h" + #include "ioctl.h" +@@ -1056,7 +1055,7 @@ struct mwifiex_adapter { + /* Device dump data/length */ + void *devdump_data; + int devdump_len; +- struct delayed_work devdump_work; ++ struct timer_list devdump_timer; + + bool ignore_btcoex_events; + }; +--- a/drivers/net/wireless/marvell/mwifiex/sta_event.c ++++ b/drivers/net/wireless/marvell/mwifiex/sta_event.c +@@ -623,8 +623,8 @@ mwifiex_fw_dump_info_event(struct mwifie + * transmission event get lost, in this cornel case, + * user would still get partial of the dump. + */ +- schedule_delayed_work(&adapter->devdump_work, +- msecs_to_jiffies(MWIFIEX_TIMER_10S)); ++ mod_timer(&adapter->devdump_timer, ++ jiffies + msecs_to_jiffies(MWIFIEX_TIMER_10S)); + } + + /* Overflow check */ +@@ -643,7 +643,7 @@ mwifiex_fw_dump_info_event(struct mwifie + return; + + upload_dump: +- cancel_delayed_work_sync(&adapter->devdump_work); ++ del_timer_sync(&adapter->devdump_timer); + mwifiex_upload_device_dump(adapter); + } + diff --git a/queue-5.18/revert-s390-smp-enforce-lowcore-protection-on-cpu-restart.patch b/queue-5.18/revert-s390-smp-enforce-lowcore-protection-on-cpu-restart.patch new file mode 100644 index 00000000000..a4c4c52ce12 --- /dev/null +++ b/queue-5.18/revert-s390-smp-enforce-lowcore-protection-on-cpu-restart.patch @@ -0,0 +1,31 @@ +From 953503751a426413ea8aee2299ae3ee971b70d9b Mon Sep 17 00:00:00 2001 +From: Alexander Gordeev +Date: Sat, 6 Aug 2022 09:29:46 +0200 +Subject: Revert "s390/smp: enforce lowcore protection on CPU restart" + +From: Alexander Gordeev + +commit 953503751a426413ea8aee2299ae3ee971b70d9b upstream. + +This reverts commit 6f5c672d17f583b081e283927f5040f726c54598. + +This breaks normal crash dump when CPU0 is offline. + +Signed-off-by: Alexander Gordeev +Signed-off-by: Greg Kroah-Hartman +--- + arch/s390/kernel/setup.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/s390/kernel/setup.c ++++ b/arch/s390/kernel/setup.c +@@ -508,8 +508,8 @@ static void __init setup_lowcore_dat_on( + S390_lowcore.svc_new_psw.mask |= PSW_MASK_DAT; + S390_lowcore.program_new_psw.mask |= PSW_MASK_DAT; + S390_lowcore.io_new_psw.mask |= PSW_MASK_DAT; +- __ctl_set_bit(0, 28); + __ctl_store(S390_lowcore.cregs_save_area, 0, 15); ++ __ctl_set_bit(0, 28); + put_abs_lowcore(restart_flags, RESTART_FLAG_CTLREGS); + put_abs_lowcore(program_new_psw, lc->program_new_psw); + for (cr = 0; cr < ARRAY_SIZE(lc->cregs_save_area); cr++) diff --git a/queue-5.18/series b/queue-5.18/series index 66d15c29479..e359f221d8d 100644 --- a/queue-5.18/series +++ b/queue-5.18/series @@ -446,13 +446,6 @@ mt76-mt7921-do-not-update-pm-states-in-case-of-error.patch mt76-mt7921s-fix-possible-sdio-deadlock-in-command-f.patch mt76-mt7921-fix-aggregation-subframes-setting-to-he-.patch mt76-mt7921-enlarge-maximum-vht-mpdu-length-to-11454.patch -mt76-mt7921-add-ap-mode-support.patch -mt76-mt7915-add-support-for-6g-in-band-discovery.patch -mt76-mt7921-rely-on-mt76_dev-in-mt7921_mac_write_txw.patch -mt76-mt7915-rely-on-mt76_dev-in-mt7915_mac_write_txw.patch -mt76-connac-move-mac-connac2-defs-in-mt76_connac2_ma.patch -mt76-connac-move-connac2_mac_write_txwi-in-mt76_conn.patch -mt76-mt7915-fix-incorrect-testmode-ipg-on-band-1-cau.patch mt76-mt7615-fix-throughput-regression-on-dfs-channel.patch mediatek-mt76-mac80211-fix-missing-of_node_put-in-mt.patch mediatek-mt76-eeprom-fix-missing-of_node_put-in-mt76.patch @@ -1083,3 +1076,20 @@ btrfs-join-running-log-transaction-when-logging-new-name.patch btrfs-convert-count_max_extents-to-use-fs_info-max_extent_size.patch net_sched-cls_route-remove-from-list-when-handle-is-0.patch arm64-kexec_file-use-more-system-keyrings-to-verify-kernel-image-signature.patch +tcp-fix-over-estimation-in-sk_forced_mem_schedule.patch +crypto-lib-blake2s-reduce-stack-frame-usage-in-self-test.patch +raw-remove-unused-variables-from-raw6_icmp_error.patch +raw-fix-a-typo-in-raw_icmp_error.patch +revert-mwifiex-fix-sleep-in-atomic-context-bugs-caused-by-dev_coredumpv.patch +mptcp-refine-memory-scheduling.patch +tracing-use-a-copy-of-the-va_list-for-__assign_vstr.patch +net-dsa-felix-fix-min-gate-len-calculation-for-tc-when-its-first-gate-is-closed.patch +revert-s390-smp-enforce-lowcore-protection-on-cpu-restart.patch +powerpc-kexec-fix-build-failure-from-uninitialised-variable.patch +drm-bridge-tc358767-fix-e-dp-bridge-endpoint-parsing-in-dedicated-function.patch +bpf-fix-sparse-warning-for-bpf_kptr_xchg_proto.patch +bpf-suppress-passing-zero-to-ptr_err-warning.patch +net-phy-smsc-disable-energy-detect-power-down-in-interrupt-mode.patch +f2fs-revive-f2fs_ioc_abort_volatile_write.patch +drm-vc4-change-vc4_dma_range_matches-from-a-global-to-static.patch +f2fs-fix-null-ptr-deref-in-f2fs_get_dnode_of_data.patch diff --git a/queue-5.18/tcp-fix-over-estimation-in-sk_forced_mem_schedule.patch b/queue-5.18/tcp-fix-over-estimation-in-sk_forced_mem_schedule.patch new file mode 100644 index 00000000000..a1693f0abea --- /dev/null +++ b/queue-5.18/tcp-fix-over-estimation-in-sk_forced_mem_schedule.patch @@ -0,0 +1,45 @@ +From c4ee118561a0f74442439b7b5b486db1ac1ddfeb Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Tue, 14 Jun 2022 10:17:33 -0700 +Subject: tcp: fix over estimation in sk_forced_mem_schedule() + +From: Eric Dumazet + +commit c4ee118561a0f74442439b7b5b486db1ac1ddfeb upstream. + +sk_forced_mem_schedule() has a bug similar to ones fixed +in commit 7c80b038d23e ("net: fix sk_wmem_schedule() and +sk_rmem_schedule() errors") + +While this bug has little chance to trigger in old kernels, +we need to fix it before the following patch. + +Fixes: d83769a580f1 ("tcp: fix possible deadlock in tcp_send_fin()") +Signed-off-by: Eric Dumazet +Acked-by: Soheil Hassas Yeganeh +Reviewed-by: Shakeel Butt +Reviewed-by: Wei Wang +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/tcp_output.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -3367,11 +3367,12 @@ void tcp_xmit_retransmit_queue(struct so + */ + void sk_forced_mem_schedule(struct sock *sk, int size) + { +- int amt; ++ int delta, amt; + +- if (size <= sk->sk_forward_alloc) ++ delta = size - sk->sk_forward_alloc; ++ if (delta <= 0) + return; +- amt = sk_mem_pages(size); ++ amt = sk_mem_pages(delta); + sk->sk_forward_alloc += amt * SK_MEM_QUANTUM; + sk_memory_allocated_add(sk, amt); + diff --git a/queue-5.18/tracing-use-a-copy-of-the-va_list-for-__assign_vstr.patch b/queue-5.18/tracing-use-a-copy-of-the-va_list-for-__assign_vstr.patch new file mode 100644 index 00000000000..0d912921883 --- /dev/null +++ b/queue-5.18/tracing-use-a-copy-of-the-va_list-for-__assign_vstr.patch @@ -0,0 +1,66 @@ +From 3a2dcbaf4d31023106975d6ae75b6df080c454cb Mon Sep 17 00:00:00 2001 +From: "Steven Rostedt (Google)" +Date: Tue, 19 Jul 2022 18:20:04 -0400 +Subject: tracing: Use a copy of the va_list for __assign_vstr() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Steven Rostedt (Google) + +commit 3a2dcbaf4d31023106975d6ae75b6df080c454cb upstream. + +If an instance of tracing enables the same trace event as another +instance, or the top level instance, or even perf, then the va_list passed +into some tracepoints can be used more than once. + +As va_list can only be traversed once, this can cause issues: + + # cat /sys/kernel/tracing/instances/qla2xxx/trace + cat-56106 [012] ..... 2419873.470098: ql_dbg_log: qla2xxx [0000:05:00.0]-1054:14: Entered (null). + cat-56106 [012] ..... 2419873.470101: ql_dbg_log: qla2xxx [0000:05:00.0]-1000:14: Entered ×+<96>²Ü<98>^H. + cat-56106 [012] ..... 2419873.470102: ql_dbg_log: qla2xxx [0000:05:00.0]-1006:14: Prepare to issue mbox cmd=0xde589000. + + # cat /sys/kernel/tracing/trace + cat-56106 [012] ..... 2419873.470097: ql_dbg_log: qla2xxx [0000:05:00.0]-1054:14: Entered qla2x00_get_firmware_state. + cat-56106 [012] ..... 2419873.470100: ql_dbg_log: qla2xxx [0000:05:00.0]-1000:14: Entered qla2x00_mailbox_command. + cat-56106 [012] ..... 2419873.470102: ql_dbg_log: qla2xxx [0000:05:00.0]-1006:14: Prepare to issue mbox cmd=0x69. + +The instance version is corrupted because the top level instance iterated +the va_list first. + +Use va_copy() in the __assign_vstr() macro to make sure that each trace +event for each use case gets a fresh va_list. + +Link: https://lore.kernel.org/all/259d53a5-958e-6508-4e45-74dba2821242@marvell.com/ +Link: https://lkml.kernel.org/r/20220719182004.21daa83e@gandalf.local.home + +Fixes: 0563231f93c6d ("tracing/events: Add __vstring() and __assign_vstr() helper macros") +Reported-by: Arun Easi +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Greg Kroah-Hartman +--- + include/trace/stages/stage6_event_callback.h | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/include/trace/stages/stage6_event_callback.h b/include/trace/stages/stage6_event_callback.h +index 0f51f6b3ab70..3c554a585320 100644 +--- a/include/trace/stages/stage6_event_callback.h ++++ b/include/trace/stages/stage6_event_callback.h +@@ -40,7 +40,12 @@ + + #undef __assign_vstr + #define __assign_vstr(dst, fmt, va) \ +- vsnprintf(__get_str(dst), TRACE_EVENT_STR_MAX, fmt, *(va)) ++ do { \ ++ va_list __cp_va; \ ++ va_copy(__cp_va, *(va)); \ ++ vsnprintf(__get_str(dst), TRACE_EVENT_STR_MAX, fmt, __cp_va); \ ++ va_end(__cp_va); \ ++ } while (0) + + #undef __bitmask + #define __bitmask(item, nr_bits) __dynamic_array(unsigned long, item, -1) +-- +2.37.2 +