From: Greg Kroah-Hartman Date: Sat, 7 Nov 2020 15:01:03 +0000 (+0100) Subject: 4.14-stable patches X-Git-Tag: v4.4.242~44 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=e13cef4cce26740883a4ff099bf7146fc9fcb6f2;p=thirdparty%2Fkernel%2Fstable-queue.git 4.14-stable patches added patches: gianfar-account-for-tx-ptp-timestamp-in-the-skb-headroom.patch gianfar-replace-skb_realloc_headroom-with-skb_cow_head-for-ptp.patch net-usb-qmi_wwan-add-telit-le910cx-0x1230-composition.patch sctp-fix-comm_lost-cant_str_assoc-err-reporting-on-big-endian-platforms.patch sfp-fix-error-handing-in-sfp_probe.patch --- diff --git a/queue-4.14/gianfar-account-for-tx-ptp-timestamp-in-the-skb-headroom.patch b/queue-4.14/gianfar-account-for-tx-ptp-timestamp-in-the-skb-headroom.patch new file mode 100644 index 00000000000..cd40ab3782b --- /dev/null +++ b/queue-4.14/gianfar-account-for-tx-ptp-timestamp-in-the-skb-headroom.patch @@ -0,0 +1,55 @@ +From foo@baz Sat Nov 7 03:52:57 PM CET 2020 +From: Claudiu Manoil +Date: Tue, 20 Oct 2020 20:36:05 +0300 +Subject: gianfar: Account for Tx PTP timestamp in the skb headroom + +From: Claudiu Manoil + +[ Upstream commit d6a076d68c6b5d6a5800f3990a513facb7016dea ] + +When PTP timestamping is enabled on Tx, the controller +inserts the Tx timestamp at the beginning of the frame +buffer, between SFD and the L2 frame header. This means +that the skb provided by the stack is required to have +enough headroom otherwise a new skb needs to be created +by the driver to accommodate the timestamp inserted by h/w. +Up until now the driver was relying on the second option, +using skb_realloc_headroom() to create a new skb to accommodate +PTP frames. Turns out that this method is not reliable, as +reallocation of skbs for PTP frames along with the required +overhead (skb_set_owner_w, consume_skb) is causing random +crashes in subsequent skb_*() calls, when multiple concurrent +TCP streams are run at the same time on the same device +(as seen in James' report). +Note that these crashes don't occur with a single TCP stream, +nor with multiple concurrent UDP streams, but only when multiple +TCP streams are run concurrently with the PTP packet flow +(doing skb reallocation). +This patch enforces the first method, by requesting enough +headroom from the stack to accommodate PTP frames, and so avoiding +skb_realloc_headroom() & co, and the crashes no longer occur. +There's no reason not to set needed_headroom to a large enough +value to accommodate PTP frames, so in this regard this patch +is a fix. + +Reported-by: James Jurack +Fixes: bee9e58c9e98 ("gianfar:don't add FCB length to hard_header_len") +Signed-off-by: Claudiu Manoil +Link: https://lore.kernel.org/r/20201020173605.1173-1-claudiu.manoil@nxp.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/freescale/gianfar.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/freescale/gianfar.c ++++ b/drivers/net/ethernet/freescale/gianfar.c +@@ -1388,7 +1388,7 @@ static int gfar_probe(struct platform_de + + if (dev->features & NETIF_F_IP_CSUM || + priv->device_flags & FSL_GIANFAR_DEV_HAS_TIMER) +- dev->needed_headroom = GMAC_FCB_LEN; ++ dev->needed_headroom = GMAC_FCB_LEN + GMAC_TXPAL_LEN; + + /* Initializing some of the rx/tx queue level parameters */ + for (i = 0; i < priv->num_tx_queues; i++) { diff --git a/queue-4.14/gianfar-replace-skb_realloc_headroom-with-skb_cow_head-for-ptp.patch b/queue-4.14/gianfar-replace-skb_realloc_headroom-with-skb_cow_head-for-ptp.patch new file mode 100644 index 00000000000..a2fe23547e7 --- /dev/null +++ b/queue-4.14/gianfar-replace-skb_realloc_headroom-with-skb_cow_head-for-ptp.patch @@ -0,0 +1,70 @@ +From foo@baz Sat Nov 7 03:52:57 PM CET 2020 +From: Claudiu Manoil +Date: Thu, 29 Oct 2020 10:10:56 +0200 +Subject: gianfar: Replace skb_realloc_headroom with skb_cow_head for PTP + +From: Claudiu Manoil + +[ Upstream commit d145c9031325fed963a887851d9fa42516efd52b ] + +When PTP timestamping is enabled on Tx, the controller +inserts the Tx timestamp at the beginning of the frame +buffer, between SFD and the L2 frame header. This means +that the skb provided by the stack is required to have +enough headroom otherwise a new skb needs to be created +by the driver to accommodate the timestamp inserted by h/w. +Up until now the driver was relying on skb_realloc_headroom() +to create new skbs to accommodate PTP frames. Turns out that +this method is not reliable in this context at least, as +skb_realloc_headroom() for PTP frames can cause random crashes, +mostly in subsequent skb_*() calls, when multiple concurrent +TCP streams are run at the same time with the PTP flow +on the same device (as seen in James' report). I also noticed +that when the system is loaded by sending multiple TCP streams, +the driver receives cloned skbs in large numbers. +skb_cow_head() instead proves to be stable in this scenario, +and not only handles cloned skbs too but it's also more efficient +and widely used in other drivers. +The commit introducing skb_realloc_headroom in the driver +goes back to 2009, commit 93c1285c5d92 +("gianfar: reallocate skb when headroom is not enough for fcb"). +For practical purposes I'm referencing a newer commit (from 2012) +that brings the code to its current structure (and fixes the PTP +case). + +Fixes: 9c4886e5e63b ("gianfar: Fix invalid TX frames returned on error queue when time stamping") +Reported-by: James Jurack +Suggested-by: Jakub Kicinski +Signed-off-by: Claudiu Manoil +Link: https://lore.kernel.org/r/20201029081057.8506-1-claudiu.manoil@nxp.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/freescale/gianfar.c | 12 ++---------- + 1 file changed, 2 insertions(+), 10 deletions(-) + +--- a/drivers/net/ethernet/freescale/gianfar.c ++++ b/drivers/net/ethernet/freescale/gianfar.c +@@ -2370,20 +2370,12 @@ static netdev_tx_t gfar_start_xmit(struc + fcb_len = GMAC_FCB_LEN + GMAC_TXPAL_LEN; + + /* make space for additional header when fcb is needed */ +- if (fcb_len && unlikely(skb_headroom(skb) < fcb_len)) { +- struct sk_buff *skb_new; +- +- skb_new = skb_realloc_headroom(skb, fcb_len); +- if (!skb_new) { ++ if (fcb_len) { ++ if (unlikely(skb_cow_head(skb, fcb_len))) { + dev->stats.tx_errors++; + dev_kfree_skb_any(skb); + return NETDEV_TX_OK; + } +- +- if (skb->sk) +- skb_set_owner_w(skb_new, skb->sk); +- dev_consume_skb_any(skb); +- skb = skb_new; + } + + /* total number of fragments in the SKB */ diff --git a/queue-4.14/net-usb-qmi_wwan-add-telit-le910cx-0x1230-composition.patch b/queue-4.14/net-usb-qmi_wwan-add-telit-le910cx-0x1230-composition.patch new file mode 100644 index 00000000000..e155d4a7098 --- /dev/null +++ b/queue-4.14/net-usb-qmi_wwan-add-telit-le910cx-0x1230-composition.patch @@ -0,0 +1,32 @@ +From foo@baz Sat Nov 7 03:52:57 PM CET 2020 +From: Daniele Palmas +Date: Mon, 2 Nov 2020 12:01:08 +0100 +Subject: net: usb: qmi_wwan: add Telit LE910Cx 0x1230 composition + +From: Daniele Palmas + +[ Upstream commit 5fd8477ed8ca77e64b93d44a6dae4aa70c191396 ] + +Add support for Telit LE910Cx 0x1230 composition: + +0x1230: tty, adb, rmnet, audio, tty, tty, tty, tty + +Signed-off-by: Daniele Palmas +Acked-by: Bjørn Mork +Link: https://lore.kernel.org/r/20201102110108.17244-1-dnlplm@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/usb/qmi_wwan.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -1257,6 +1257,7 @@ static const struct usb_device_id produc + {QMI_FIXED_INTF(0x1bc7, 0x1101, 3)}, /* Telit ME910 dual modem */ + {QMI_FIXED_INTF(0x1bc7, 0x1200, 5)}, /* Telit LE920 */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x1201, 2)}, /* Telit LE920, LE920A4 */ ++ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1230, 2)}, /* Telit LE910Cx */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x1260, 2)}, /* Telit LE910Cx */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x1261, 2)}, /* Telit LE910Cx */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x1900, 1)}, /* Telit LN940 series */ diff --git a/queue-4.14/sctp-fix-comm_lost-cant_str_assoc-err-reporting-on-big-endian-platforms.patch b/queue-4.14/sctp-fix-comm_lost-cant_str_assoc-err-reporting-on-big-endian-platforms.patch new file mode 100644 index 00000000000..59bc9ac76c9 --- /dev/null +++ b/queue-4.14/sctp-fix-comm_lost-cant_str_assoc-err-reporting-on-big-endian-platforms.patch @@ -0,0 +1,44 @@ +From foo@baz Sat Nov 7 03:52:57 PM CET 2020 +From: Petr Malat +Date: Fri, 30 Oct 2020 14:26:33 +0100 +Subject: sctp: Fix COMM_LOST/CANT_STR_ASSOC err reporting on big-endian platforms + +From: Petr Malat + +[ Upstream commit b6df8c81412190fbd5eaa3cec7f642142d9c16cd ] + +Commit 978aa0474115 ("sctp: fix some type cast warnings introduced since +very beginning")' broke err reading from sctp_arg, because it reads the +value as 32-bit integer, although the value is stored as 16-bit integer. +Later this value is passed to the userspace in 16-bit variable, thus the +user always gets 0 on big-endian platforms. Fix it by reading the __u16 +field of sctp_arg union, as reading err field would produce a sparse +warning. + +Fixes: 978aa0474115 ("sctp: fix some type cast warnings introduced since very beginning") +Signed-off-by: Petr Malat +Acked-by: Marcelo Ricardo Leitner +Link: https://lore.kernel.org/r/20201030132633.7045-1-oss@malat.biz +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/sctp/sm_sideeffect.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/net/sctp/sm_sideeffect.c ++++ b/net/sctp/sm_sideeffect.c +@@ -1591,12 +1591,12 @@ static int sctp_cmd_interpreter(enum sct + break; + + case SCTP_CMD_INIT_FAILED: +- sctp_cmd_init_failed(commands, asoc, cmd->obj.u32); ++ sctp_cmd_init_failed(commands, asoc, cmd->obj.u16); + break; + + case SCTP_CMD_ASSOC_FAILED: + sctp_cmd_assoc_failed(commands, asoc, event_type, +- subtype, chunk, cmd->obj.u32); ++ subtype, chunk, cmd->obj.u16); + break; + + case SCTP_CMD_INIT_COUNTER_INC: diff --git a/queue-4.14/series b/queue-4.14/series index 11b42e2d77d..be2f0288f8d 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -1,3 +1,8 @@ drm-i915-break-up-error-capture-compression-loops-with-cond_resched.patch xen-events-don-t-use-chip_data-for-legacy-irqs.patch tipc-fix-use-after-free-in-tipc_bcast_get_mode.patch +gianfar-replace-skb_realloc_headroom-with-skb_cow_head-for-ptp.patch +gianfar-account-for-tx-ptp-timestamp-in-the-skb-headroom.patch +net-usb-qmi_wwan-add-telit-le910cx-0x1230-composition.patch +sctp-fix-comm_lost-cant_str_assoc-err-reporting-on-big-endian-platforms.patch +sfp-fix-error-handing-in-sfp_probe.patch diff --git a/queue-4.14/sfp-fix-error-handing-in-sfp_probe.patch b/queue-4.14/sfp-fix-error-handing-in-sfp_probe.patch new file mode 100644 index 00000000000..6ebbf1780f7 --- /dev/null +++ b/queue-4.14/sfp-fix-error-handing-in-sfp_probe.patch @@ -0,0 +1,34 @@ +From foo@baz Sat Nov 7 03:39:50 PM CET 2020 +From: YueHaibing +Date: Sat, 31 Oct 2020 11:10:53 +0800 +Subject: sfp: Fix error handing in sfp_probe() + +From: YueHaibing + +[ Upstream commit 9621618130bf7e83635367c13b9a6ee53935bb37 ] + +gpiod_to_irq() never return 0, but returns negative in +case of error, check it and set gpio_irq to 0. + +Fixes: 73970055450e ("sfp: add SFP module support") +Signed-off-by: YueHaibing +Reviewed-by: Andrew Lunn +Link: https://lore.kernel.org/r/20201031031053.25264-1-yuehaibing@huawei.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/phy/sfp.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/phy/sfp.c ++++ b/drivers/net/phy/sfp.c +@@ -881,7 +881,8 @@ static int sfp_probe(struct platform_dev + continue; + + irq = gpiod_to_irq(sfp->gpio[i]); +- if (!irq) { ++ if (irq < 0) { ++ irq = 0; + poll = true; + continue; + }